Spyware / Malware / Virus Removal

Buffer Overrun Detected In Explorer.exe

43 min read

Looking for the outcome? Ask AI

coheedKid Topic Starter

Post #1May 15, 2007, 11:23 PM UTC

Hey. lately, everytime i'm on the computer, eventually a message pops up and reads:

Buffer Overrun Detected!

Program: C:\WINDOWS\explorer.exe

ive tried running all of my spyware removal things but it keeps coming up. help would be so so appreciated.

here's my hijackthis log. thanks a lot!

Logfile of HijackThis v1.99.1
Scan saved at 6:11:05 PM, on 5/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\kdx\KHost.exe
C:\Program Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\SmileyDistrict\plugin.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package

Applications\Residence.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.netscape.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =

about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =

http://aimhome.netscape.com/aimhome.adp
R3 - URLSearchHook: AOLTBSearch Class -

{EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar

2.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Protection Bar - {44d22a64-2399-4edf-8b32-f2c729c1e8a7} -

C:\Program Files\MMediaCodec\iesplugin.dll (file missing)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} -

C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital

Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program

Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe
O4 - HKLM\..\Run: [hpfsched] C:\WINDOWS\hpfsched.exe
O4 - HKLM\..\Run: [hpidschd.exe -log – -log] C:\Program

Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft

IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy

Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [Smiley District] C:\Program

Files\SmileyDistrict\plugin.exe
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program

Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [InfoData] rundll32.exe

"C:\WINDOWS\system32\sxyajxja.dll",realset
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [AIM] C:\Program

Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"

/background
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program

Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program

Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM

Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program

files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program

Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Smiley District - {0418F3E3-C763-4e02-9EC5-F0AE13B54B0F}

- C:\Program Files\SmileyDistrict\insmile.dll
O9 - Extra 'Tools' menuitem: Smiley District -

{0418F3E3-C763-4e02-9EC5-F0AE13B54B0F} - C:\Program

Files\SmileyDistrict\insmile.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

(file missing)
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} -

C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -

C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}

- C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com -

{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program

Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

%windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network

Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -

C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .asx:

c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .avi:

c:\progra~1\netscape\commun~1\program\PLUGINS\npavi32.dll
O12 - Plugin for .wma:

c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: C:\Program

Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine

Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/windowsupdate/…86/client/wuweb

_site.cab?1153174521812
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) -

http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?322
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) -

http://www.gamespot.com/KDX/kdx.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) -

http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) -

http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 -

HKLM\System\CCS\Services\Tcpip\..\{82018730-5904-4A73-9DF2-FAFB92A08EEF}:

NameServer = 68.94.156.1 151.164.8.201
O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} -

C:\WINDOWS\System32\dpfwu.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation

- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec

Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton

AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -

C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software,

Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation -

C:\Program Files\Viewpoint\Common\ViewpointService.exe

miekiemoes

Post #2May 20, 2007, 8:49 AM UTC

Hello,

The current formatting of your log makes it difficult to read, so in notepad:
On top, click Format >uncheck Word Wrap

Also, I see you have Viewpoint installed…
Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546
I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

Viewpoint
Viewpoint Manager
Viewpoint Media Player

Also uninstall SmileyDistrict if still present.

I also notice that you have Weatherbug installed on your computer – This is very much an ad-enabled application which in addition to providing current outdoor temperature information in the System Tray together with real-time weather alerts can also draw unwanted ads and popups to your computer.
You may also want to read this why weatherbug is not recommended: http://fravia.com/weatherbug.htm

If you want a program which provides weather information there is an ad-free alternative to Weatherbug called WeatherWatcher which is available free from http://www.snapfiles.com/get/weatherwatcher.html.

Of course this remains entirely your choice, but please be aware that if you decide to continue using Weatherbug, your computer will be at an increased risk of infection from malware.

Then, * Download Combofix to your desktop.
Doubleclick combofix.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
Do NOT post the ComboFix-quarantined-files.txt - unless I ask you to.

coheedKid

Post #3May 27, 2007, 12:08 AM UTC

thanks so much for your help man.

here's the combofix txt, i hope its what you wanted:
"Owner" - 2007-05-26 18:46:01 Service Pack 2
ComboFix 07-05.26.3.V - Running from: "C:\Documents and Settings\Owner\Desktop\"

(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\eteksxkp.dll
C:\WINDOWS\system32\sxyajxja.dll
C:\WINDOWS\system32\vfhpiabl.dll
C:\WINDOWS\system32\ajxjayxs.ini

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\WINDOWS\system32\ .txt"
"C:\WINDOWS\hosts"

((((((((((((((((((((((((((((((( Files Created from 2007-04-26 to 2007-05-26 ))))))))))))))))))))))))))))))))))

2007-05-26 18:38 102,400 –a—— C:\WINDOWS\system32\unzip32.dll
2007-05-26 18:38 d——– C:\Program Files\Weather Watcher

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-26 23:35:34 ——– d—–w C:\Program Files\SmileyDistrict
2007-05-26 23:35:21 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Viewpoint
2007-05-26 23:35:20 ——– d—–w C:\Program Files\Viewpoint
2007-05-26 23:32:35 ——– d—–w C:\Program Files\Soulseek
2007-05-25 12:35:30 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\WeatherBug
2007-05-23 03:18:05 ——– d—–w C:\Program Files\DC++
2007-05-13 03:12:17 ——– d—–w C:\Program Files\Winamp
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 19:34:31 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Lionhead Studios
2007-04-17 00:54:36 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-04-17 00:38:43 ——– d—–w C:\Program Files\Lionhead Studios Ltd
2007-04-10 16:01:50 163,644 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 —-a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\system32\win32k.sys
2007-02-27 03:49:39 77,896 —-a-w C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4efb-9B51-7695ECA05670}=C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll [2004-09-29 13:02]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}=C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll [2005-08-02 13:41]
{87e2e3ec-7cbc-4a16-9600-a7f6668917b8}=C:\WINDOWS\System32\opnstlue.dll [2006-03-19 17:21]
{9FAC6B93-CE8E-4B40-8CA1-0A46D385DBF1}=C:\WINDOWS\Config\ofntsvs.dll [2007-05-04 15:52]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 22:02]
"nwiz"="nwiz.exe" [2003-08-19 04:56 C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2003-11-10 13:30]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2001-03-27 16:33]
"hpidschd.exe"="" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2003-12-12 19:50]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-01-30 18:05]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 02:50]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-05-10 16:04]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2005-08-03 01:36]
"Smiley District"="C:\Program Files\SmileyDistrict\plugin.exe" [2006-05-17 02:47]
"VideoraiPodConverter"="C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe" [2005-11-11 13:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-12 01:58]
"AlcxMonitor"="ALCXMNTR.EXE" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"NVIEW"="nview.dll,nViewLoadHook" []
"AIM"="C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe" [2006-08-01 16:35]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2005-06-14 10:05]
"Weather"="C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" [2004-09-09 18:35]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"WeatherWatcher"="C:\Program Files\Weather Watcher\ww.exe" [2007-05-12 10:23]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="C:\WINDOWS\System32\dpfwu.dll" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="C:\WINDOWS\System32\dpfwu.dll" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ofntsvs]
C:\WINDOWS\Config\ofntsvs.dll

*Newly Created Service* -PROCEXP90

Contents of the 'Scheduled Tasks' folder
2007-05-06 19:09:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-05-26 01:22:51 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
2007-05-26 23:01:15 C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-26 18:56:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

********************************************************************

Completion time: 2007-05-26 18:58:30
C:\ComboFix-quarantined-files.txt … 2007-05-26 18:58

— E O F —
(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\eteksxkp.dll
C:\WINDOWS\system32\sxyajxja.dll
C:\WINDOWS\system32\vfhpiabl.dll
C:\WINDOWS\system32\ajxjayxs.ini

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\WINDOWS\system32\ .txt"
"C:\WINDOWS\hosts"

((((((((((((((((((((((((((((((( Files Created from 05/2-01-07 to 05/26/2007 ))))))))))))))))))))))))))))))))))

(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\eteksxkp.dll
C:\WINDOWS\system32\sxyajxja.dll
C:\WINDOWS\system32\vfhpiabl.dll
C:\WINDOWS\system32\ajxjayxs.ini

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\WINDOWS\system32\ .txt"
"C:\WINDOWS\hosts"

((((((((((((((((((((((((((((((( Files Created from 05/2-01-07 to 05/26/2007 ))))))))))))))))))))))))))))))))))

and here's the new hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 7:07:14 PM, on 5/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\kdx\KHost.exe
C:\Program Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\SmileyDistrict\plugin.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Soulseek\slsk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\explorer.exe
C:\ComboFix\8861.cfexe
C:\ComboFix\9064.cfexe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://aimhome.netscape.com/aimhome.adp
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Protection Bar - {44d22a64-2399-4edf-8b32-f2c729c1e8a7} - C:\Program Files\MMediaCodec\iesplugin.dll (file missing)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [hpidschd.exe -log – -log] C:\Program Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [Smiley District] C:\Program Files\SmileyDistrict\plugin.exe
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [AIM] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Smiley District - {0418F3E3-C763-4e02-9EC5-F0AE13B54B0F} - C:\Program Files\SmileyDistrict\insmile.dll (file missing)
O9 - Extra 'Tools' menuitem: Smiley District - {0418F3E3-C763-4e02-9EC5-F0AE13B54B0F} - C:\Program Files\SmileyDistrict\insmile.dll (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .asx: c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .avi: c:\progra~1\netscape\commun~1\program\PLUGINS\npavi32.dll
O12 - Plugin for .wma: c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153174521812
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?322
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{82018730-5904-4A73-9DF2-FAFB92A08EEF}: NameServer = 68.94.156.1 151.164.8.201
O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

thanks a lot.

miekiemoes

Post #4May 27, 2007, 7:40 AM UTC last edited May 27, 2007, 7:41 AM UTC

Hi,

A remark first..

I notice that you have Weatherbug installed on your computer – This is very much an ad-enabled application which in addition to providing current outdoor temperature information in the System Tray together with real-time weather alerts can also draw unwanted ads and popups to your computer.
You may also want to read this why weatherbug is not recommended: http://fravia.com/weatherbug.htm

Our recommendation would be to uninstall it using the Add or Remove Programs feature in Control Panel.

You are already having Weather Watcher, so why having two Weather programs?

Of course this remains entirely your choice, but please be aware that if you decide to continue using Weatherbug, your computer will be at an increased risk of infection from malware.

Also, uninstall Smiley District

Then reboot.

After reboot, Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\Config\ofntsvs.dll
C:\WINDOWS\System32\opnstlue.dll

Folder::
C:\Program Files\SmileyDistrict
C:\DOCUME~1\Owner\APPLIC~1\Viewpoint
C:\Program Files\Viewpoint

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ofntsvs]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87e2e3ec-7cbc-4a16-9600-a7f6668917b8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FAC6B93-CE8E-4B40-8CA1-0A46D385DBF1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smiley District"=-
"AlcxMonitor"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"=-

Save this as ComboFix-Do.txt

Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.

coheedKid

Post #5May 27, 2007, 4:08 PM UTC

Real Quick…

I removed viewpoint media player and smilie district and weatherbug from the add/remove programs and they're still here. so that may be another problem

here's the combofix log:

"Owner" - 2007-05-27 10:36:26 Service Pack 2
ComboFix 07-05.26.3.V - Running from: "C:\Documents and Settings\Owner\"
Command switches used :: ""C:\Documents and Settings\Owner\Desktop\ComboFix-Do.txt""

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\Program Files\SmileyDistrict\plugin.dll"
"C:\Program Files\SmileyDistrict\plugin.exe"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\UpdateVersionList_v2.mtx"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1241215004.mtx"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-2131688416.mtz"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\URLCache.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1233786184.mtx"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1355542221.mts"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\660436749.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\667423248.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\URLCache.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\407034558.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\URLCache.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1005093974.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1110148037.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\4317525.mtj&p2=1&p3=12000646022397854533837909620594&p4=50335505"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\URLCache.ini"
"C:\WINDOWS\System32\opnstlue.dll"
"C:\Program Files\SmileyDistrict"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint"
"C:\Program Files\Viewpoint"
"C:\WINDOWS\Config\ofntsvs.dll"

((((((((((((((((((((((((((((((( Files Created from 2007-04-27 to 2007-05-27 ))))))))))))))))))))))))))))))))))

2007-05-26 18:58 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-05-26 18:38 102,400 –a—— C:\WINDOWS\system32\unzip32.dll
2007-05-26 18:38 d——– C:\Program Files\Weather Watcher

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-27 06:37:52 ——– d—–w C:\Program Files\Soulseek
2007-05-25 12:35:30 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\WeatherBug
2007-05-23 03:18:05 ——– d—–w C:\Program Files\DC++
2007-05-13 03:12:17 ——– d—–w C:\Program Files\Winamp
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 19:34:31 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Lionhead Studios
2007-04-17 00:54:36 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-04-17 00:38:43 ——– d—–w C:\Program Files\Lionhead Studios Ltd
2007-04-10 16:01:50 163,644 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 —-a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\system32\win32k.sys
2007-02-27 03:49:39 77,896 —-a-w C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4efb-9B51-7695ECA05670}=C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll [2004-09-29 13:02]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}=C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll [2005-08-02 13:41]
{AC63E727-A2DF-4CF5-BF96-A4D52BF20A45}=C:\WINDOWS\Config\ofntsvs.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 09:23]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 22:02]
"nwiz"="nwiz.exe" [2003-08-19 04:56 C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2003-11-10 13:30]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2001-03-27 16:33]
"hpidschd.exe"="" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2003-12-12 19:50]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-01-30 18:05]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 02:50]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-05-10 16:04]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2005-08-03 01:36]
"VideoraiPodConverter"="C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe" [2005-11-11 13:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-12 01:58]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"NVIEW"="nview.dll,nViewLoadHook" []
"AIM"="C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe" [2006-08-01 16:35]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2005-06-14 10:05]
"Weather"="C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" [2004-09-09 18:35]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"WeatherWatcher"="C:\Program Files\Weather Watcher\ww.exe" [2007-05-12 10:23]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="C:\WINDOWS\System32\dpfwu.dll" []

Contents of the 'Scheduled Tasks' folder
2007-05-06 19:09:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-05-26 01:22:51 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
2007-05-27 15:51:34 C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-27 10:51:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

********************************************************************

Completion time: 2007-05-27 10:54:28 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-05-27 10:53
C:\ComboFix2.txt … 2007-05-26 19:03

— E O F —
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\Program Files\SmileyDistrict\plugin.dll"
"C:\Program Files\SmileyDistrict\plugin.exe"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\UpdateVersionList_v2.mtx"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-1241215004.mtx"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\-2131688416.mtz"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00\URLCache.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1233786184.mtx"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\-1355542221.mts"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\660436749.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\667423248.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01\URLCache.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\407034558.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02\URLCache.ini"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1005093974.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\1110148037.swf"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\4317525.mtj&p2=1&p3=12000646022397854533837909620594&p4=50335505"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03\URLCache.ini"
"C:\WINDOWS\System32\opnstlue.dll"
"C:\Program Files\SmileyDistrict"
"C:\DOCUME~1\Owner\APPLIC~1\Viewpoint"
"C:\Program Files\Viewpoint"
"C:\WINDOWS\Config\ofntsvs.dll"

((((((((((((((((((((((((((((((( Files Created from 05/2-01-07 to 05/27/2007 ))))))))))))))))))))))))))))))))))

05/27/2007 10:36 AM C:\64 ComboFix.txt.bat

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-27 06:37:52 ——– d—–w C:\Program Files\Soulseek
2007-05-25 12:35:30 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\WeatherBug
2007-05-23 03:18:05 ——– d—–w C:\Program Files\DC++
2007-05-13 03:12:17 ——– d—–w C:\Program Files\Winamp
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 19:34:31 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Lionhead Studios
2007-04-17 00:54:36 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-04-17 00:38:43 ——– d—–w C:\Program Files\Lionhead Studios Ltd
2007-04-10 16:01:50 163,644 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 —-a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\system32\win32k.sys
2007-02-27 03:49:39 77,896 —-a-w C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-02-09 11:10:35 574,464 —-a-w C:\WINDOWS\system32\drivers\ntfs.sys
2007-02-06 03:12:02 ——– d—–w C:\Program Files\FLStudio4
2007-02-05 20:17:02 185,344 —-a-w C:\WINDOWS\system32\upnphost.dll
2007-01-19 07:19:14 ——– d—–w C:\Program Files\Messenger
2007-01-19 07:18:09 ——– d—–w C:\Program Files\MSXML 4.0
2007-01-17 22:17:01 ——– d—–w C:\Program Files\Movie Maker
2007-01-17 22:11:10 ——– d—–w C:\Program Files\Windows NT
2007-01-09 01:01:14 17,408 —-a-w C:\WINDOWS\system32\corpol.dll
2006-11-08 05:06:13 679,424 —-a-w C:\WINDOWS\system32\inetcomm.dll
2006-11-08 03:03:36 413,696 —-a-w C:\WINDOWS\system32\vbscript.dll
2006-11-08 03:03:36 156,160 —-a-w C:\WINDOWS\system32\msls31.dll
2006-11-07 09:26:44 71,680 —-a-w C:\WINDOWS\system32\admparse.dll
2006-11-07 09:26:42 55,296 —-a-w C:\WINDOWS\system32\iesetup.dll
2006-11-04 20:14:00 1,245,696 —-a-w C:\WINDOWS\system32\msxml4.dll
2006-11-01 19:17:45 927,504 —-a-w C:\WINDOWS\system32\mfc40u.dll
2006-10-19 13:56:32 713,216 —-a-w C:\WINDOWS\system32\sxs.dll
2006-10-17 18:06:00 78,336 —-a-w C:\WINDOWS\system32\ieencode.dll
2006-10-17 18:05:10 40,960 —-a-w C:\WINDOWS\system32\licmgr10.dll
2006-10-17 17:57:58 36,352 —-a-w C:\WINDOWS\system32\imgutil.dll
2006-10-17 17:56:10 45,568 —-a-w C:\WINDOWS\system32\mshta.exe
2006-10-17 17:28:56 48,128 —-a-w C:\WINDOWS\system32\mshtmler.dll
2006-10-16 16:15:00 122,880 —-a-w C:\WINDOWS\system32\oledlg.dll
2006-10-14 08:13:25 981,760 —-a-w C:\WINDOWS\system32\mfc42u.dll
2006-10-13 12:35:12 142,336 —-a-w C:\WINDOWS\system32\nwprovau.dll
2006-09-30 15:37:04 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Digital Album Organizer
2006-09-16 16:53:35 ——– d—–w C:\Program Files\QuickTime
2006-09-16 16:24:37 ——– d—–w C:\Program Files\iTunes
2006-09-16 16:24:26 ——– d—–w C:\Program Files\iPod
2006-09-16 16:19:42 ——– d—–w C:\Program Files\Apple Software Update
2006-09-13 05:09:16 1,110,528 —-a-w C:\WINDOWS\system32\msxml3.dll
2006-08-25 15:45:58 617,472 —-a-w C:\WINDOWS\system32\comctl32.dll
2006-08-22 10:05:26 498,742 —-a-w C:\WINDOWS\system32\dxmasf.dll
2006-08-21 15:52:08 246,814 —-a-w C:\WINDOWS\system32\strmdll.dll
2006-08-21 12:21:06 16,896 —-a-w C:\WINDOWS\system32\fltlib.dll
2006-08-21 09:14:58 23,040 —-a-w C:\WINDOWS\system32\fltmc.exe
2006-08-21 09:14:58 128,896 ——w C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-17 12:28:27 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2006-08-17 12:28:27 132,096 —-a-w C:\WINDOWS\system32\wkssvc.dll
2006-08-16 11:58:05 100,352 —-a-w C:\WINDOWS\system32\6to4svc.dll
2006-08-16 09:37:30 225,664 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2006-08-14 10:34:41 332,928 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2006-07-21 08:24:43 72,704 —-a-w C:\WINDOWS\system32\hlink.dll
2006-07-17 22:06:46 ——– d—–w C:\Program Files\Word Zen
2006-07-14 20:03:02 14,448 —-a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2006-07-14 19:51:18 108,144 —-a-w C:\WINDOWS\system32\GEARAspi.dll
2006-07-13 08:48:58 202,240 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2006-07-03 01:00:15 ——– d—–w C:\Program Files\VideoraiPodConverter
2006-07-03 01:00:13 ——– d—–w C:\Program Files\AviSynth 2.5
2006-06-29 14:05:44 26,112 ——w C:\WINDOWS\system32\idndl.dll
2006-06-29 14:05:44 23,552 ——w C:\WINDOWS\system32\normaliz.dll
2006-06-28 23:59:26 24,576 ——w C:\WINDOWS\system32\nlsdl.dll
2006-06-22 05:06:30 1,435,648 —-a-w C:\WINDOWS\system32\query.dll
2006-06-22 05:06:29 69,120 —-a-w C:\WINDOWS\system32\ciodm.dll
2006-06-14 09:00:45 82,944 —-a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2006-06-14 08:47:46 6,400 —-a-w C:\WINDOWS\system32\drivers\splitter.sys
2006-06-14 08:47:45 172,416 —-a-w C:\WINDOWS\system32\drivers\kmixer.sys
2006-06-03 20:22:35 699,758 —-a-w C:\WINDOWS\system32\srvtcp.exe
2006-06-03 20:22:32 1,237,012 —-a-w C:\WINDOWS\system32\cydmsghb.exe
2006-05-18 11:28:25 ——– d—–w C:\Program Files\Microsoft IntelliPoint
2006-05-05 09:47:57 174,592 —-a-w C:\WINDOWS\system32\drivers\rdbss.sys
2006-05-05 09:41:45 453,120 —-a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2006-04-20 11:51:50 359,808 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2006-03-24 04:37:50 49,152 —-a-w C:\WINDOWS\system32\wdigest.dll
2006-03-17 00:38:01 28,672 —-a-w C:\WINDOWS\system32\verclsid.exe
2006-03-17 00:33:10 262,784 ——w C:\WINDOWS\system32\drivers\http.sys
2006-03-01 19:42:42 956,416 —-a-w C:\WINDOWS\system32\msdtctm.dll
2006-03-01 19:42:42 91,136 —-a-w C:\WINDOWS\system32\mtxoci.dll
2006-03-01 19:42:42 66,560 —-a-w C:\WINDOWS\system32\mtxclu.dll
2006-03-01 19:42:42 426,496 —-a-w C:\WINDOWS\system32\msdtcprx.dll
2006-03-01 19:42:42 161,280 —-a-w C:\WINDOWS\system32\msdtcuiu.dll
2006-03-01 19:42:42 11,776 —-a-w C:\WINDOWS\system32\xolehlp.dll
2006-02-15 00:22:26 142,464 —-a-w C:\WINDOWS\system32\drivers\aec.sys
2006-01-04 03:35:05 68,096 —-a-w C:\WINDOWS\system32\webclnt.dll
2006-01-01 20:10:36 ——– d—–w C:\Program Files\Bridge Builder
2005-12-26 20:44:44 ——– d—–w C:\Program Files\City of Heroes
2005-12-05 22:33:10 94,228 —-a-w C:\WINDOWS\system32\xwivrwrf.dll
2005-11-22 00:02:20 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Google
2005-11-12 16:29:40 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\.BitTornado
2005-11-12 16:27:33 ——– d—–w C:\Program Files\BitTorrent
2005-11-01 23:31:00 3,349 —-a-w C:\WINDOWS\mozver.dat
2005-10-24 14:25:21 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Microsoft Games
2005-10-20 22:20:03 1,082,368 —-a-w C:\WINDOWS\system32\esent.dll
2005-10-17 21:14:46 118,272 —-a-w C:\WINDOWS\system32\t2embed.dll
2005-10-17 21:14:45 80,896 —-a-w C:\WINDOWS\system32\fontsub.dll
2005-10-07 17:14:52 308,224 —-a-w C:\WINDOWS\system32\avisynth.dll
2005-10-01 19:49:15 99,965 —-a-w C:\WINDOWS\UninstallFirefox.exe
2005-09-20 23:21:13 ——– d—–w C:\Program Files\MSN Messenger
2005-09-20 23:20:25 ——– d—–w C:\Program Files\Microsoft Works
2005-09-20 23:15:50 ——– d—–w C:\Program Files\Common Files\Symantec Shared
2005-09-19 01:12:25 ——– d—–w C:\Program Files\Webroot
2005-09-19 01:12:25 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Webroot
2005-09-10 01:53:41 2,067,968 —-a-w C:\WINDOWS\system32\cdosys.dll
2005-09-01 01:41:53 19,968 —-a-w C:\WINDOWS\system32\linkinfo.dll
2005-08-30 03:54:26 1,287,168 —-a-w C:\WINDOWS\system32\quartz.dll
2005-08-29 18:27:06 23,304 —-a-w C:\WINDOWS\system32\GWFSPidGen.DLL
2005-08-29 13:22:59 ——– d—–w C:\Program Files\MUSICMATCH
2005-08-29 13:22:08 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Musicmatch
2005-08-23 03:35:42 123,392 —-a-w C:\WINDOWS\system32\umpnpmgr.dll
2005-08-22 18:29:46 197,632 —-a-w C:\WINDOWS\system32\netman.dll
2005-08-03 06:36:10 424,960 —-a-w C:\WINDOWS\WRServices.dll
2005-07-27 21:12:28 102,912 —-a-w C:\WINDOWS\system32\islzma.dll
2005-07-26 04:39:49 397,824 —-a-w C:\WINDOWS\system32\rpcss.dll
2005-07-26 04:39:49 37,888 —-a-w C:\WINDOWS\system32\olecnv32.dll
2005-07-26 04:39:49 101,376 —-a-w C:\WINDOWS\system32\txflog.dll
2005-07-26 04:39:48 74,752 —-a-w C:\WINDOWS\system32\olecli32.dll
2005-07-26 04:39:48 1,285,120 —-a-w C:\WINDOWS\system32\ole32.dll
2005-07-26 04:39:45 540,160 —-a-w C:\WINDOWS\system32\comuid.dll
2005-07-26 04:39:45 243,200 —-a-w C:\WINDOWS\system32\es.dll
2005-07-26 04:39:44 97,792 —-a-w C:\WINDOWS\system32\comrepl.dll
2005-07-26 04:39:44 1,267,200 —-a-w C:\WINDOWS\system32\comsvcs.dll
2005-07-26 04:39:43 625,152 —-a-w C:\WINDOWS\system32\catsrvut.dll
2005-07-26 04:39:43 60,416 —-a-w C:\WINDOWS\system32\colbact.dll
2005-07-26 04:39:43 498,688 —-a-w C:\WINDOWS\system32\clbcatq.dll
2005-07-26 04:39:43 110,080 —-a-w C:\WINDOWS\system32\clbcatex.dll
2005-07-26 04:39:42 225,792 —-a-w C:\WINDOWS\system32\catsrv.dll
2005-07-08 16:27:56 249,344 —-a-w C:\WINDOWS\system32\tapisrv.dll
2005-06-29 01:46:00 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2005-06-29 01:46:00 254,976 —-a-w C:\WINDOWS\system32\icm32.dll
2005-06-28 16:21:34 22,752 —-a-w C:\WINDOWS\system32\spupdsvc.exe
2005-06-27 23:34:55 ——– d—–w C:\Program Files\mIRC
2005-06-27 19:03:26 108,544 —-a-w C:\WINDOWS\system32\pxcpyi64.exe
2005-06-27 19:02:50 104,960 —-a-w C:\WINDOWS\system32\pxinsi64.exe
2005-06-27 18:56:20 20,576 —-a-w C:\WINDOWS\system32\drivers\pxhelp20.sys
2005-06-24 16:59:54 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Apple Computer
2005-06-17 17:44:31 ——– d—–w C:\Program Files\PartyPoker
2005-06-16 22:56:11 ——– d—–w C:\Program Files\Fujifilm e-Systems
2005-06-16 22:55:48 ——– d—–w C:\Program Files\Common Files\InstallShield
2005-06-16 04:15:33 ——– d—–w C:\Program Files\Vstplugins
2005-06-16 04:14:54 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Sony
2005-06-16 04:08:43 ——– d—–w C:\Program Files\Microsoft SQL Server
2005-06-16 04:03:41 ——– d—–w C:\Program Files\Sony
2005-06-16 04:02:43 ——– d—–w C:\Program Files\Sony Setup
2005-06-15 17:49:30 295,936 —-a-w C:\WINDOWS\system32\kerberos.dll
2005-06-13 22:45:11 ——– d—–w C:\Program Files\DivX
2005-06-10 23:53:32 57,856 —-a-w C:\WINDOWS\system32\spoolsv.exe
2005-06-10 04:09:46 139,528 —-a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2005-05-27 02:04:27 41,472 —-a-w C:\WINDOWS\system32\hhsetup.dll
2005-05-27 02:04:27 155,136 —-a-w C:\WINDOWS\system32\itircl.dll
2005-05-27 02:04:27 137,216 —-a-w C:\WINDOWS\system32\itss.dll
2005-05-26 23:22:01 10,752 —-a-w C:\WINDOWS\hh.exe
2005-05-26 21:34:52 2,297,552 —-a-w C:\WINDOWS\system32\d3dx9_26.dll
2005-05-26 09:19:32 173,536 —-a-w C:\WINDOWS\system32\wuweb.dll
2005-05-26 09:16:30 465,176 —-a-w C:\WINDOWS\system32\wuapi.dll
2005-05-26 09:16:30 41,240 —-a-w C:\WINDOWS\system32\wups.dll
2005-05-26 09:16:30 194,328 —-a-w C:\WINDOWS\system32\wuaueng1.dll
2005-05-26 09:16:30 18,200 —-a-w C:\WINDOWS\system32\wups2.dll
2005-05-26 09:16:30 172,312 —-a-w C:\WINDOWS\system32\wuauclt1.exe
2005-05-26 09:16:30 127,256 —-a-w C:\WINDOWS\system32\wucltui.dll
2005-05-26 09:16:30 124,184 —-a-w C:\WINDOWS\system32\wuauclt.exe
2005-05-26 09:16:30 1,343,768 —-a-w C:\WINDOWS\system32\wuaueng.dll
2005-05-26 09:16:24 75,544 —-a-w C:\WINDOWS\system32\cdm.dll
2005-05-26 09:16:24 198,424 —-a-w C:\WINDOWS\system32\iuengine.dll
2005-05-10 23:45:48 75,776 —-a-w C:\WINDOWS\system32\telnet.exe
2005-05-04 19:45:36 884,736 —-a-w C:\WINDOWS\system32\msimsg.dll
2005-05-04 19:45:36 78,848 —-a-w C:\WINDOWS\system32\msiexec.exe
2005-05-04 19:45:36 271,360 —-a-w C:\WINDOWS\system32\msihnd.dll
2005-05-04 19:45:36 15,360 —-a-w C:\WINDOWS\system32\msisip.dll
2005-03-17 22:30:11 ——– d—–w C:\Program Files\Microsoft IntelliPoint 5.2
2005-03-02 18:09:29 56,832 —-a-w C:\WINDOWS\system32\authz.dll
2005-03-02 03:29:06 348,160 ——w C:\WINDOWS\system32\msvcr71.dll
2005-03-02 03:27:38 503,808 —-a-w C:\WINDOWS\system32\msvcp71.dll
2005-01-30 23:07:55 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Real
2005-01-30 23:05:58 ——– d—–w C:\Program Files\Common Files\xing shared
2005-01-30 23:05:55 ——– d—–w C:\Program Files\Common Files\Real
2005-01-30 20:57:04 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Aim
2005-01-30 20:56:58 ——– d—–w C:\Program Files\AWS
2005-01-28 18:44:28 96,768 —-a-w C:\WINDOWS\system32\logagent.exe
2005-01-28 18:44:28 96,768 —-a-w C:\WINDOWS\system32\drmstor.dll
2005-01-28 18:44:28 940,544 —-a-w C:\WINDOWS\system32\wmspdmoe.dll
2005-01-28 18:44:28 895,736 —-a-w C:\WINDOWS\system32\wmvdmod.dll
2005-01-28 18:44:28 774,904 —-a-w C:\WINDOWS\system32\wmsdmod.dll
2005-01-28 18:44:28 716,288 —-a-w C:\WINDOWS\system32\wmadmoe.dll
2005-01-28 18:44:28 66,560 —-a-w C:\WINDOWS\system32\wpdmtpus.dll
2005-01-28 18:44:28 61,952 —-a-w C:\WINDOWS\system32\wpdconns.dll
2005-01-28 18:44:28 6,656 —-a-w C:\WINDOWS\system32\laprxy.dll
2005-01-28 18:44:28 502,272 —-a-w C:\WINDOWS\system32\drmv2clt.dll
2005-01-28 18:44:28 47,104 —-a-w C:\WINDOWS\system32\uwdf.exe
2005-01-28 18:44:28 413,944 —-a-w C:\WINDOWS\system32\wmspdmod.dll
2005-01-28 18:44:28 396,528 —-a-w C:\WINDOWS\system32\wmadmod.dll
2005-01-28 18:44:28 38,912 —-a-w C:\WINDOWS\system32\wpd_ci.dll
2005-01-28 18:44:28 38,912 —-a-w C:\WINDOWS\system32\wdfmgr.exe
2005-01-28 18:44:28 364,784 —-a-w C:\WINDOWS\system32\MSSCP.dll
2005-01-28 18:44:28 335,872 —-a-w C:\WINDOWS\system32\WMDRMdev.dll
2005-01-28 18:44:28 331,776 —-a-w C:\WINDOWS\system32\wpdmtpdr.dll
2005-01-28 18:44:28 331,264 —-a-w C:\WINDOWS\system32\wpdsp.dll
2005-01-28 18:44:28 33,792 —-a-w C:\WINDOWS\system32\WMDMPS.dll
2005-01-28 18:44:28 315,904 —-a-w C:\WINDOWS\system32\MSWMDM.dll
2005-01-28 18:44:28 294,912 —-a-w C:\WINDOWS\system32\blackbox.dll
2005-01-28 18:44:28 290,816 —-a-w C:\WINDOWS\system32\WMDRMNet.dll
2005-01-28 18:44:28 28,160 —-a-w C:\WINDOWS\system32\WMDMLOG.dll
2005-01-28 18:44:28 258,296 —-a-w C:\WINDOWS\system32\drmclien.dll
2005-01-28 18:44:28 25,088 —-a-w C:\WINDOWS\system32\MsPMSNSv.dll
2005-01-28 18:44:28 224,768 —-a-w C:\WINDOWS\system32\wmasf.dll
2005-01-28 18:44:28 221,184 —-a-w C:\WINDOWS\system32\qasf.dll
2005-01-28 18:44:28 18,944 —-a-w C:\WINDOWS\system32\drivers\wpdusb.sys
2005-01-28 18:44:28 173,568 —-a-w C:\WINDOWS\system32\MsPMSP.dll
2005-01-28 18:44:28 164,864 —-a-w C:\WINDOWS\system32\cewmdm.dll
2005-01-28 18:44:28 150,016 —-a-w C:\WINDOWS\system32\wmidx.dll
2005-01-28 18:44:28 15,872 —-a-w C:\WINDOWS\system32\wdfapi.dll
2005-01-28 18:44:28 142,336 —-a-w C:\WINDOWS\system32\msnetobj.dll
2005-01-28 18:44:28 114,176 —-a-w C:\WINDOWS\system32\wpdmtp.dll
2005-01-28 18:44:28 10,752 —-a-w C:\WINDOWS\system32\wpdtrace.dll
2005-01-28 18:44:28 1,512,448 —-a-w C:\WINDOWS\system32\WMVADVE.DLL
2005-01-28 18:44:28 1,218,808 —-a-w C:\WINDOWS\system32\wmvadvd.dll
2005-01-28 18:44:28 1,119,744 —-a-w C:\WINDOWS\system32\wmsdmoe2.dll
2005-01-28 18:44:28 1,027,072 —-a-w C:\WINDOWS\system32\wmnetmgr.dll
2005-01-28 18:44:28 1,003,008 —-a-w C:\WINDOWS\system32\wmvdmoe2.dll
2005-01-07 15:25:09 ——– d—–w C:\Program Files\InterActual
2004-12-30 21:40:06 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Publish Providers
2004-12-30 21:40:06 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\NetMedia Providers
2004-12-30 21:39:54 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Sonic Foundry
2004-12-30 21:35:26 ——– d—–w C:\Program Files\Sonic Foundry
2004-12-30 21:34:26 ——– d—–w C:\Program Files\Sonic Foundry Setup
2004-12-19 04:32:32 38,229 —-a-w C:\WINDOWS\system32\drivers\StMp3Rec.sys
2004-12-07 19:32:34 96,768 —-a-w C:\WINDOWS\system32\srvsvc.dll
2004-12-02 22:20:40 1,843,200 —-a-w C:\WINDOWS\system32\NCTAudioFile2.dll
2004-11-17 17:41:24 347,136 —-a-w C:\WINDOWS\system32\hypertrm.dll
2004-11-12 04:07:35 ——– d—–w C:\Program Files\Yahoo!
2004-10-30 19:03:58 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2004-10-26 22:55:39 ——– d—a-w C:\Program Files\Lycos
2004-10-26 22:39:05 3,375,104 —-a-w C:\WINDOWS\system32\qt-mt331.dll
2004-10-26 22:39:04 53,248 —-a-w C:\WINDOWS\system32\dpv10.dll
2004-10-26 22:39:03 602,112 —-a-w C:\WINDOWS\system32\dpuGUI10.dll
2004-10-26 22:39:03 335,872 —-a-w C:\WINDOWS\system32\dpus10.dll
2004-10-26 22:39:03 290,816 —-a-w C:\WINDOWS\system32\dpu10.dll
2004-10-26 22:38:24 1,335,296 —-a-w C:\WINDOWS\system32\PSIKey.dll
2004-10-26 22:38:23 716,800 —-a-w C:\WINDOWS\system32\DivX.dll
2004-10-26 22:38:18 94,208 —-a-w C:\WINDOWS\system32\divxdec_0411.dll
2004-10-26 22:38:18 94,208 —-a-w C:\WINDOWS\system32\divxdec_040c.dll
2004-10-26 22:38:18 94,208 —-a-w C:\WINDOWS\system32\divxdec_0407.dll
2004-10-26 22:38:18 528,384 —-a-w C:\WINDOWS\system32\divx_xx11.dll
2004-10-26 22:38:18 206,336 —-a-w C:\WINDOWS\system32\divx_xx0c.dll
2004-10-26 22:38:17 206,848 —-a-w C:\WINDOWS\system32\divx_xx07.dll
2004-10-26 22:11:30 245,408 —-a-w C:\WINDOWS\system32\unicows.dll
2004-10-26 22:04:00 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Lavasoft
2004-10-26 22:03:53 ——– d—–w C:\Program Files\Lavasoft
2004-10-25 16:57:57 67,000 —-a-w C:\WINDOWS\blocklist.reg
2004-10-11 22:37:46 ——– d—–w C:\Program Files\Mjuice Media Player
2004-10-08 01:16:04 35,840 —-a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2004-10-07 19:50:50 72,704 —-a-w C:\WINDOWS\system32\zlibwapi.dll
2004-10-02 21:11:05 ——– d—–w C:\Program Files\Common Files\NSV
2004-10-01 16:24:02 2,279,424 —-a-w C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2004-09-29 22:28:37 134,912 —-a-w C:\WINDOWS\system32\drivers\ipnat.sys
2004-09-19 21:08:33 ——– d–h–w C:\Program Files\Zero G Registry
2004-09-19 21:08:07 ——– d—–w C:\Program Files\Britannica 2004
2004-09-12 21:36:40 ——– d—–w C:\Program Files\Broderbund
2004-09-12 21:36:28 ——– d—–w C:\Program Files\Common Files\Broderbund
2004-09-07 19:47:52 57,344 —-a-w C:\WINDOWS\ALCXMNTR.EXE
2004-09-01 19:45:46 225,280 —-a-w C:\WINDOWS\system32\ReWire.dll
2004-08-25 00:42:17 ——– d—–w C:\Program Files\AttachmentOptions
2004-08-25 00:42:00 73,216 —-a-w C:\WINDOWS\ST6UNST.EXE
2004-08-25 00:42:00 249,856 ——w C:\WINDOWS\Setup1.exe
2004-08-25 00:35:59 ——– d—–w C:\Program Files\Microsoft ActiveSync
2004-08-24 21:57:25 ——– d—–w C:\Program Files\Hewlett-Packard
2004-08-24 21:54:18 ——– d—–w C:\Program Files\HP DeskJet 810C Series
2004-08-24 21:52:23 ——– d–h–w C:\DOCUME~1\Owner\APPLIC~1\GTek
2004-08-24 21:08:36 ——– d–h–w C:\Program Files\WindowsUpdate
2004-08-23 22:12:56 1,346,200 —-a-w C:\WINDOWS\system32\LTRDF14n.DLL
2004-08-23 22:12:54 1,298,584 —-a-w C:\WINDOWS\system32\LTRDK14n.DLL
2004-08-23 22:12:44 360,072 —-a-w C:\WINDOWS\system32\LTRIO14N.DLL
2004-08-23 22:12:38 1,263,256 —-a-w C:\WINDOWS\system32\LTRPR14N.DLL
2004-08-23 22:12:24 1,020,040 —-a-w C:\WINDOWS\system32\LTR14N.DLL
2004-08-23 22:08:14 1,232,896 —-a-w C:\WINDOWS\system32\Lfsid14s.dll
2004-08-23 22:08:12 204,800 —-a-w C:\WINDOWS\system32\lfdwf14s.dll
2004-08-23 22:08:08 339,456 —-a-w C:\WINDOWS\system32\lfPCL14s.dll
2004-08-23 22:08:08 281,088 —-a-w C:\WINDOWS\system32\LfGbr14s.dll
2004-08-23 22:08:08 250,880 —-a-w C:\WINDOWS\system32\lfshp14s.dll
2004-08-23 22:08:06 77,312 —-a-w C:\WINDOWS\system32\lfpct14s.dll
2004-08-23 22:08:06 265,216 —-a-w C:\WINDOWS\system32\lfvpg14s.dll
2004-08-23 22:08:04 737,280 —-a-w C:\WINDOWS\system32\lfsvg14s.dll
2004-08-23 22:08:00 369,152 —-a-w C:\WINDOWS\system32\lfdxf14s.dll
2004-08-23 22:07:58 309,248 —-a-w C:\WINDOWS\system32\lfdwg14s.dll
2004-08-23 22:07:58 245,248 —-a-w C:\WINDOWS\system32\lfacs14s.dll
2004-08-23 22:07:56 266,752 —-a-w C:\WINDOWS\system32\lfdrw14s.dll
2004-08-23 22:07:56 264,704 —-a-w C:\WINDOWS\system32\lfcgm14s.dll
2004-08-23 22:07:56 250,880 —-a-w C:\WINDOWS\system32\Lfdgn14s.dll
2004-08-23 22:07:54 30,208 —-a-w C:\WINDOWS\system32\lfRaw14s.dll
2004-08-23 22:07:54 208,384 —-a-w C:\WINDOWS\system32\lfsct14s.dll
2004-08-23 22:07:52 288,768 —-a-w C:\WINDOWS\system32\lfpsp14s.dll
2004-08-23 22:07:50 64,512 —-a-w C:\WINDOWS\system32\lfXpm14s.dll
2004-08-23 22:07:50 38,400 —-a-w C:\WINDOWS\system32\lfxwd14s.dll
2004-08-23 22:07:48 59,904 —-a-w C:\WINDOWS\system32\lfXbm14s.dll
2004-08-23 22:07:48 37,376 —-a-w C:\WINDOWS\system32\lfwmp14s.dll
2004-08-23 22:07:48 32,768 —-a-w C:\WINDOWS\system32\lfwpg14s.dll
2004-08-23 22:07:46 49,664 —-a-w C:\WINDOWS\system32\lfwmf14s.dll
2004-08-23 22:07:46 32,768 —-a-w C:\WINDOWS\system32\lfwfx14s.dll
2004-08-23 22:07:46 158,720 —-a-w C:\WINDOWS\system32\lftif14s.dll
2004-08-23 22:07:44 83,456 —-a-w C:\WINDOWS\system32\lfptk14s.dll
2004-08-23 22:07:44 36,864 —-a-w C:\WINDOWS\system32\LFSMP14s.dll
2004-08-23 22:07:44 35,840 —-a-w C:\WINDOWS\system32\lftga14s.dll
2004-08-23 22:07:44 33,280 —-a-w C:\WINDOWS\system32\lfras14s.dll
2004-08-23 22:07:44 32,768 —-a-w C:\WINDOWS\system32\lfsgi14s.dll
2004-08-23 22:07:42 90,112 —-a-w C:\WINDOWS\system32\lfpsd14s.dll
2004-08-23 22:07:42 43,008 —-a-w C:\WINDOWS\system32\LFPNM14s.dll
2004-08-23 22:07:42 150,016 —-a-w C:\WINDOWS\system32\Lfpng14s.dll
2004-08-23 22:07:40 37,888 —-a-w C:\WINDOWS\system32\lfpcx14s.dll
2004-08-23 22:07:40 32,256 —-a-w C:\WINDOWS\system32\lfpcd14s.dll
2004-08-23 22:07:38 31,744 —-a-w C:\WINDOWS\system32\lfmsp14s.dll
2004-08-23 22:07:38 31,232 —-a-w C:\WINDOWS\system32\lfmac14s.dll
2004-08-23 22:07:36 43,520 —-a-w C:\WINDOWS\system32\lflmb14s.dll
2004-08-23 22:07:36 40,960 —-a-w C:\WINDOWS\system32\lflma14s.dll
2004-08-23 22:07:36 35,840 —-a-w C:\WINDOWS\system32\lfKDC14s.dll
2004-08-23 22:07:36 256,000 —-a-w C:\WINDOWS\system32\LFJ2K14s.dll
2004-08-23 22:07:34 98,304 —-a-w C:\WINDOWS\system32\lfjbg14s.dll
2004-08-23 22:07:34 40,448 —-a-w C:\WINDOWS\system32\lfiff14s.dll
2004-08-23 22:07:34 32,768 —-a-w C:\WINDOWS\system32\lfitg14s.dll
2004-08-23 22:07:34 32,768 —-a-w C:\WINDOWS\system32\lfimg14s.dll
2004-08-23 22:07:32 93,184 —-a-w C:\WINDOWS\system32\lffpx14s.dll
2004-08-23 22:07:32 75,264 —-a-w C:\WINDOWS\system32\lfica14s.dll
2004-08-23 22:07:32 47,616 —-a-w C:\WINDOWS\system32\LFGIF14s.dll
2004-08-23 22:07:30 92,160 —-a-w C:\WINDOWS\system32\lffax14s.dll
2004-08-23 22:07:30 66,048 —-a-w C:\WINDOWS\system32\lfcal14s.dll
2004-08-23 22:07:30 57,856 —-a-w C:\WINDOWS\system32\lfeps14s.dll
2004-08-23 22:07:24 1,454,592 —-a-w C:\WINDOWS\system32\LTDic14s.dll
2004-08-23 22:07:20 8,192 —-a-w C:\WINDOWS\system32\lfecw14s.dll
2004-08-23 22:07:18 56,320 —-a-w C:\WINDOWS\system32\lfDCS14s.dll
2004-08-23 22:07:18 32,768 —-a-w C:\WINDOWS\system32\lfcin14s.dll
2004-08-23 22:07:18 32,256 —-a-w C:\WINDOWS\system32\lfcrw14s.dll
2004-08-23 22:07:16 427,008 —-a-w C:\WINDOWS\system32\LFCMW14s.dll
2004-08-23 22:07:16 33,280 —-a-w C:\WINDOWS\system32\lfCUT14s.dll
2004-08-23 22:07:12 409,088 —-a-w C:\WINDOWS\system32\LFCMP14s.DLL
2004-08-23 22:07:12 36,864 —-a-w C:\WINDOWS\system32\lfclp14s.dll
2004-08-23 22:07:10 43,008 —-a-w C:\WINDOWS\system32\lfbmp14s.dll
2004-08-23 22:07:08 36,864 —-a-w C:\WINDOWS\system32\lfani14s.dll
2004-08-23 22:07:08 36,352 —-a-w C:\WINDOWS\system32\lfawd14s.dll
2004-08-23 22:07:06 303,616 —-a-w C:\WINDOWS\system32\lfAFP14s.dll
2004-08-19 18:35:20 235,520 —-a-w C:\WINDOWS\system32\lfvec14s.dll
2004-08-15 21:14:27 ——– d—–w C:\Program Files\PT Software
2004-08-15 21:09:24 ——– d—–w C:\Program Files\Power Tab Software
2004-08-12 18:01:28 33,792 —-a-w C:\WINDOWS\system32\lfSFF14s.dll
2004-08-12 18:00:00 80,896 —-a-w C:\WINDOWS\system32\LFDCR14s.dll
2004-08-12 17:50:26 2,224,128 —-a-w C:\WINDOWS\system32\LTCLR14s.dll
2004-08-11 11:41:08 270,336 —-a-w C:\WINDOWS\system32\WMVCreator.dll
2004-08-11 11:03:32 135,168 —-a-w C:\WINDOWS\system32\MPEGCreator.dll
2004-08-11 11:03:13 147,456 —-a-w C:\WINDOWS\system32\AVICreator.dll
2004-08-04 08:07:21 1,788 —-a-w C:\WINDOWS\system32\dcache.bin
2004-08-04 08:02:44 329,728 —-a-w C:\WINDOWS\system32\netsetup.exe
2004-08-04 08:01:08 87,176 —-a-w C:\WINDOWS\system32\rdpwsx.dll
2004-08-04 08:01:07 92,168 —-a-w C:\WINDOWS\system32\rdpdd.dll
2004-08-04 08:01:07 40,840 —-a-w C:\WINDOWS\system32\drivers\termdd.sys
2004-08-04 08:01:07 21,896 —-a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2004-08-04 08:01:07 12,168 —-a-w C:\WINDOWS\system32\tsddd.dll
2004-08-04 08:01:07 12,040 —-a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2004-08-04 07:56:57 9,216 —-a-w C:\WINDOWS\system32\scrnsave.scr
2004-08-04 07:56:57 704,512 —-a-w C:\WINDOWS\system32\ss3dfo.scr
2004-08-04 07:56:57 679,936 —-a-w C:\WINDOWS\system32\sstext3d.scr
2004-08-04 07:56:57 65,536 —-a-w C:\WINDOWS\system32\wextract.exe
2004-08-04 07:56:57 610,304 —-a-w C:\WINDOWS\system32\sspipes.scr
2004-08-04 07:56:57 538,624 —-a-w C:\WINDOWS\system32\spider.exe
2004-08-04 07:56:57 502,272 —-a-w C:\WINDOWS\system32\winlogon.exe
2004-08-04 07:56:57 50,176 —-a-w C:\WINDOWS\system32\utilman.exe
2004-08-04 07:56:57 5,632 —-a-w C:\WINDOWS\system32\winver.exe
2004-08-04 07:56:57 47,104 —-a-w C:\WINDOWS\system32\ssmypics.scr
2004-08-04 07:56:57 433,664 —-a-w C:\WINDOWS\system32\wiaacmgr.exe
2004-08-04 07:56:57 393,216 —-a-w C:\WINDOWS\system32\ssflwbox.scr
2004-08-04 07:56:57 347,136 —-a-w C:\WINDOWS\system32\tourstart.exe
2004-08-04 07:56:57 32,256 —-a-w C:\WINDOWS\system32\wpnpinst.exe
2004-08-04 07:56:57 32,256 —-a-w C:\WINDOWS\system32\wpabaln.exe
2004-08-04 07:56:57 30,720 —-a-w C:\WINDOWS\system32\xcopy.exe
2004-08-04 07:56:57 289,792 —-a-w C:\WINDOWS\system32\vssvc.exe
2004-08-04 07:56:57 283,648 —-a-w C:\WINDOWS\winhlp32.exe
2004-08-04 07:56:57 24,576 —-a-w C:\WINDOWS\system32\userinit.exe
2004-08-04 07:56:57 220,672 —-a-w C:\WINDOWS\system32\logon.scr
2004-08-04 07:56:57 21,504 ——w C:\WINDOWS\system32\spupdwxp.exe
2004-08-04 07:56:57 20,992 —-a-w C:\WINDOWS\system32\ssmarque.scr
2004-08-04 07:56:57 19,968 —-a-w C:\WINDOWS\system32\ssbezier.scr
2004-08-04 07:56:57 18,944 —-a-w C:\WINDOWS\system32\ssmyst.scr
2004-08-04 07:56:57 18,432 —-a-w C:\WINDOWS\system32\ups.exe
2004-08-04 07:56:57 16,896 —-a-w C:\WINDOWS\system32\upnpcont.exe
2004-08-04 07:56:57 14,848 —-a-w C:\WINDOWS\system32\stimon.exe
2004-08-04 07:56:57 14,336 —-a-w C:\WINDOWS\system32\svchost.exe
2004-08-04 07:56:57 14,336 —-a-w C:\WINDOWS\system32\ssstars.scr
2004-08-04 07:56:57 135,680 —-a-w C:\WINDOWS\system32\taskmgr.exe
2004-08-04 07:56:57 13,824 ——w C:\WINDOWS\system32\wscntfy.exe
2004-08-04 07:56:57 12,288 —-a-w C:\WINDOWS\system32\tracert.exe
2004-08-04 07:56:57 114,688 —-a-w C:\WINDOWS\system32\wscript.exe
2004-08-04 07:56:57 105,984 —-a-w C:\WINDOWS\system32\sysocmgr.exe
2004-08-04 07:56:56 89,600 —-a-w C:\WINDOWS\system32\smlogsvc.exe
2004-08-04 07:56:56 8,192 —-a-w C:\WINDOWS\system32\spdwnwxp.exe
2004-08-04 07:56:56 8,192 ——w C:\WINDOWS\system32\smbinst.exe
2004-08-04 07:56:56 77,824 —-a-w C:\WINDOWS\system32\shrpubw.exe
2004-08-04 07:56:56 73,796 ——w C:\WINDOWS\system32\slserv.exe
2004-08-04 07:56:56 70,144 —-a-w C:\WINDOWS\system32\sigverif.exe
2004-08-04 07:56:56 50,688 —-a-w C:\WINDOWS\system32\smss.exe
2004-08-04 07:56:56 42,496 —-a-w C:\WINDOWS\system32\shmgrate.exe
2004-08-04 07:56:56 32,866 ——w C:\WINDOWS\system32\slrundll.exe
2004-08-04 07:56:56 32,866 ——w C:\WINDOWS\slrundll.exe
2004-08-04 07:56:56 31,232 —-a-w C:\WINDOWS\system32\sethc.exe
2004-08-04 07:56:56 26,112 —-a-w C:\WINDOWS\system32\skeys.exe
2004-08-04 07:56:56 23,040 —-a-w C:\WINDOWS\system32\setup.exe
2004-08-04 07:56:56 19,456 —-a-w C:\WINDOWS\system32\shutdown.exe
2004-08-04 07:56:56 140,800 —-a-w C:\WINDOWS\system32\sessmgr.exe
2004-08-04 07:56:56 131,584 —-a-w C:\WINDOWS\system32\sndrec32.exe
2004-08-04 07:56:55 95,744 —-a-w C:\WINDOWS\system32\scardsvr.exe
2004-08-04 07:56:55 9,216 ——w C:\WINDOWS\system32\proxycfg.exe
2004-08-04 07:56:55 77,312 —-a-w C:\WINDOWS\system32\sdbinst.exe
2004-08-04 07:56:55 77,312 —-a-w C:\WINDOWS\system32\rtcshare.exe
2004-08-04 07:56:55 67,072 —-a-w C:\WINDOWS\system32\rdshost.exe
2004-08-04 07:56:55 62,464 —-a-w C:\WINDOWS\system32\rdpclip.exe
2004-08-04 07:56:55 58,368 —-a-w C:\WINDOWS\system32\packager.exe
2004-08-04 07:56:55 56,832 —-a-w C:\WINDOWS\system32\rasphone.exe
2004-08-04 07:56:55 50,176 —-a-w C:\WINDOWS\system32\reg.exe
2004-08-04 07:56:55 50,176 —-a-w C:\WINDOWS\system32\proquota.exe
2004-08-04 07:56:55 49,152 ——w C:\WINDOWS\system32\powercfg.exe
2004-08-04 07:56:55 35,840 —-a-w C:\WINDOWS\system32\rcimlby.exe
2004-08-04 07:56:55 33,280 —-a-w C:\WINDOWS\system32\rundll32.exe
2004-08-04 07:56:55 215,552 —-a-w C:\WINDOWS\system32\osk.exe
2004-08-04 07:56:55 21,504 —-a-w C:\WINDOWS\system32\rcp.exe
2004-08-04 07:56:55 20,480 —-a-w C:\WINDOWS\system32\qprocess.exe
2004-08-04 07:56:55 17,920 —-a-w C:\WINDOWS\system32\ping.exe
2004-08-04 07:56:55 15,872 —-a-w C:\WINDOWS\system32\perfmon.exe
2004-08-04 07:56:55 146,432 —-a-w C:\WINDOWS\regedit.exe
2004-08-04 07:56:55 14,848 —-a-w C:\WINDOWS\system32\rsh.exe
2004-08-04 07:56:55 14,336 —-a-w C:\WINDOWS\system32\runonce.exe
2004-08-04 07:56:55 13,824 —-a-w C:\WINDOWS\system32\rexec.exe
2004-08-04 07:56:55 13,824 —-a-w C:\WINDOWS\system32\rdsaddin.exe
2004-08-04 07:56:55 13,312 —-a-w C:\WINDOWS\system32\savedump.exe
2004-08-04 07:56:55 11,776 —-a-w C:\WINDOWS\system32\regsvr32.exe
2004-08-04 07:56:55 109,568 —-a-w C:\WINDOWS\system32\progman.exe
2004-08-04 07:56:55 108,032 —-a-w C:\WINDOWS\system32\services.exe
2004-08-04 07:56:54 86,016 —-a-w C:\WINDOWS\system32\netsh.exe
2004-08-04 07:56:54 76,800 —-a-w C:\WINDOWS\system32\nslookup.exe
2004-08-04 07:56:54 69,632 —-a-w C:\WINDOWS\system32\odbcconf.exe
2004-08-04 07:56:54 69,120 —-a-w C:\WINDOWS\system32\notepad.exe
2004-08-04 07:56:54 69,120 —-a-w C:\WINDOWS\notepad.exe
2004-08-04 07:56:54 53,760 —-a-w C:\WINDOWS\system32\narrator.exe
2004-08-04 07:56:54 42,496 —-a-w C:\WINDOWS\system32\net.exe
2004-08-04 07:56:54 419,840 —-a-w C:\WINDOWS\system32\ntvdm.exe
2004-08-04 07:56:54 4,096 —-a-w C:\WINDOWS\system32\nddeapir.exe
2004-08-04 07:56:54 36,864 —-a-w C:\WINDOWS\system32\netstat.exe
2004-08-04 07:56:54 32,768 —-a-w C:\WINDOWS\system32\odbcad32.exe
2004-08-04 07:56:54 124,928 —-a-w C:\WINDOWS\system32\net1.exe
2004-08-04 07:56:54 111,104 —-a-w C:\WINDOWS\system32\netdde.exe
2004-08-04 07:56:53 6,144 —-a-w C:\WINDOWS\system32\msdtc.exe
2004-08-04 07:56:53 343,040 —-a-w C:\WINDOWS\system32\mspaint.exe
2004-08-04 07:56:53 12,288 —-a-w C:\WINDOWS\system32\mstinit.exe
2004-08-04 07:56:52 123,392 —-a-w C:\WINDOWS\system32\mplay32.exe
2004-08-04 07:56:51 815,104 —-a-w C:\WINDOWS\system32\mmc.exe
2004-08-04 07:56:51 32,768 —-a-w C:\WINDOWS\system32\mnmsrvc.exe
2004-08-04 07:56:51 143,360 —-a-w C:\WINDOWS\system32\mobsync.exe
2004-08-04 07:56:50 85,504 —-a-w C:\WINDOWS\system32\makecab.exe
2004-08-04 07:56:50 75,264 —-a-w C:\WINDOWS\system32\locator.exe
2004-08-04 07:56:50 72,704 —-a-w C:\WINDOWS\system32\magnify.exe
2004-08-04 07:56:50 59,392 ——w C:\WINDOWS\system32\logman.exe
2004-08-04 07:56:50 55,808 —-a-w C:\WINDOWS\system32\ipconfig.exe
2004-08-04 07:56:50 53,248 —-a-w C:\WINDOWS\system32\ipv6.exe
2004-08-04 07:56:50 514,560 —-a-w C:\WINDOWS\system32\logonui.exe
2004-08-04 07:56:50 23,552 —-a-w C:\WINDOWS\system32\ipxroute.exe
2004-08-04 07:56:50 150,016 —-a-w C:\WINDOWS\system32\imapi.exe
2004-08-04 07:56:50 13,312 —-a-w C:\WINDOWS\system32\lsass.exe
2004-08-04 07:56:50 114,688 —-a-w C:\WINDOWS\system32\iexpress.exe
2004-08-04 07:56:49 45,568 —-a-w C:\WINDOWS\system32\extrac32.exe
2004-08-04 07:56:49 42,496 —-a-w C:\WINDOWS\system32\ftp.exe
2004-08-04 07:56:49 39,424 —-a-w C:\WINDOWS\system32\grpconv.exe
2004-08-04 07:56:49 27,136 —-a-w C:\WINDOWS\system32\findstr.exe
2004-08-04 07:56:49 267,776 —-a-w C:\WINDOWS\system32\fxssvc.exe
2004-08-04 07:56:49 229,376 —-a-w C:\WINDOWS\system32\fxscover.exe
2004-08-04 07:56:49 20,992 —-a-w C:\WINDOWS\system32\fontview.exe
2004-08-04 07:56:49 20,992 ——w C:\WINDOWS\system32\faxpatch.exe
2004-08-04 07:56:49 193,024 —-a-w C:\WINDOWS\system32\eudcedit.exe
2004-08-04 07:56:49 193,024 ——w C:\WINDOWS\system32\fsquirt.exe
2004-08-04 07:56:49 143,360 —-a-w C:\WINDOWS\system32\fxsclnt.exe
2004-08-04 07:56:49 1,032,192 —-a-w C:\WINDOWS\explorer.exe
2004-08-04 07:56:48 98,304 —-a-w C:\WINDOWS\system32\cscript.exe
2004-08-04 07:56:48 85,504 —-a-w C:\WINDOWS\system32\diantz.exe
2004-08-04 07:56:48 83,456 —-a-w C:\WINDOWS\system32\dpvsetup.exe
2004-08-04 07:56:48 82,432 —-a-w C:\WINDOWS\system32\dfrgfat.exe
2004-08-04 07:56:48 63,488 —-a-w C:\WINDOWS\system32\cmstp.exe
2004-08-04 07:56:48 47,104 —-a-w C:\WINDOWS\system32\cmdl32.exe
2004-08-04 07:56:48 39,936 —-a-w C:\WINDOWS\system32\cmmon32.exe
2004-08-04 07:56:48 388,608 —-a-w C:\WINDOWS\system32\cmd.exe
2004-08-04 07:56:48 30,208 —-a-w C:\WINDOWS\system32\dplaysvr.exe
2004-08-04 07:56:48 30,208 —-a-w C:\WINDOWS\system32\ddeshare.exe
2004-08-04 07:56:48 27,648 —-a-w C:\WINDOWS\system32\conime.exe
2004-08-04 07:56:48 25,088 —-a-w C:\WINDOWS\system32\defrag.exe
2004-08-04 07:56:48 224,768 —-a-w C:\WINDOWS\system32\dmadmin.exe
2004-08-04 07:56:48 180,224 —-a-w C:\WINDOWS\system32\dwwin.exe
2004-08-04 07:56:48 18,432 —-a-w C:\WINDOWS\system32\dpnsvr.exe
2004-08-04 07:56:48 17,920 —-a-w C:\WINDOWS\system32\dvdupgrd.exe
2004-08-04 07:56:48 163,840 —-a-w C:\WINDOWS\system32\diskpart.exe
2004-08-04 07:56:48 15,872 —-a-w C:\WINDOWS\system32\dmremote.exe
2004-08-04 07:56:48 15,360 —-a-w C:\WINDOWS\system32\ctfmon.exe
2004-08-04 07:56:48 10,752 —-a-w C:\WINDOWS\system32\dumprep.exe
2004-08-04 07:56:48 1,298,432 —-a-w C:\WINDOWS\system32\dxdiag.exe
2004-08-04 07:56:47 98,304 —-a-w C:\WINDOWS\system32\ahui.exe
2004-08-04 07:56:47 71,680 ——w C:\WINDOWS\system32\blastcln.exe
2004-08-04 07:56:47 64,000 —-a-w C:\WINDOWS\system32\cleanmgr.exe
2004-08-04 07:56:47 602,624 —-a-w C:\WINDOWS\system32\autoconv.exe
2004-08-04 07:56:47 588,800 —-a-w C:\WINDOWS\system32\autochk.exe
2004-08-04 07:56:47 580,608 —-a-w C:\WINDOWS\system32\autofmt.exe
2004-08-04 07:56:47 5,632 —-a-w C:\WINDOWS\system32\cisvc.exe
2004-08-04 07:56:47 44,544 —-a-w C:\WINDOWS\system32\alg.exe
2004-08-04 07:56:47 4,096 —-a-w C:\WINDOWS\system32\actmovie.exe
2004-08-04 07:56:47 33,280 —-a-w C:\WINDOWS\system32\clipsrv.exe
2004-08-04 07:56:47 25,088 —-a-w C:\WINDOWS\system32\at.exe
2004-08-04 07:56:47 20,480 —-a-w C:\WINDOWS\system32\cliconfg.exe
2004-08-04 07:56:47 183,808 —-a-w C:\WINDOWS\system32\accwiz.exe
2004-08-04 07:56:47 14,336 ——w C:\WINDOWS\system32\auditusr.exe
2004-08-04 07:56:47 11,264 —-a-w C:\WINDOWS\system32\autolfn.exe
2004-08-04 07:56:47 11,264 —-a-w C:\WINDOWS\system32\atmadm.exe
2004-08-04 07:56:47 102,912 —-a-w C:\WINDOWS\system32\clipbrd.exe
2004-08-04 07:56:46 99,328 —-a-w C:\WINDOWS\system32\winscard.dll
2004-08-04 07:56:46 984,576 —-a-w C:\WINDOWS\system32\syssetup.dll
2004-08-04 07:56:46 93,696 —-a-w C:\WINDOWS\system32\tscfgwmi.dll
2004-08-04 07:56:46 92,672 —-a-w C:\WINDOWS\system32\wlnotify.dll
2004-08-04 07:56:46 91,648 —-a-w C:\WINDOWS\system32\xactsrv.dll
2004-08-04 07:56:46 90,624 —-a-w C:\WINDOWS\system32\trkwks.dll
2004-08-04 07:56:46 858,624 —-a-w C:\WINDOWS\system32\tapi3.dll
2004-08-04 07:56:46 82,944 —-a-w C:\WINDOWS\system32\ws2_32.dll
2004-08-04 07:56:46 81,408 ——w C:\WINDOWS\system32\wscsvc.dll
2004-08-04 07:56:46 75,776 —-a-w C:\WINDOWS\system32\wiascr.dll
2004-08-04 07:56:46 74,240 —-a-w C:\WINDOWS\system32\usbui.dll
2004-08-04 07:56:46 74,240 —-a-w C:\WINDOWS\system32\unimdmat.dll
2004-08-04 07:56:46 723,456 —-a-w C:\WINDOWS\system32\userenv.dll
2004-08-04 07:56:46 65,536 —-a-w C:\WINDOWS\system32\wshext.dll
2004-08-04 07:56:46 6,656 —-a-w C:\WINDOWS\system32\wuauserv.dll
2004-08-04 07:56:46 589,312 —-a-w C:\WINDOWS\system32\wiashext.dll
2004-08-04 07:56:46 57,856 —-a-w C:\WINDOWS\system32\synceng.dll
2004-08-04 07:56:46 53,760 —-a-w C:\WINDOWS\system32\winsta.dll
2004-08-04 07:56:46 53,760 —-a-w C:\WINDOWS\system32\vfwwdm32.dll
2004-08-04 07:56:46 51,712 —-a-w C:\WINDOWS\system32\wzcsapi.dll
2004-08-04 07:56:46 51,712 —-a-w C:\WINDOWS\system32\vdmredir.dll
2004-08-04 07:56:46 50,688 —-a-w C:\WINDOWS\twain_32.dll
2004-08-04 07:56:46 50,688 —-a-w C:\WINDOWS\system32\wstdecod.dll
2004-08-04 07:56:46 50,176 ——w C:\WINDOWS\system32\xmlprovi.dll
2004-08-04 07:56:46 463,360 —-a-w C:\WINDOWS\system32\wiadefui.dll
2004-08-04 07:56:46 45,568 —-a-w C:\WINDOWS\system32\tcpmonui.dll
2004-08-04 07:56:46 45,568 —-a-w C:\WINDOWS\system32\tcpmon.dll
2004-08-04 07:56:46 44,032 ——w C:\WINDOWS\system32\twext.dll
2004-08-04 07:56:46 430,592 —-a-w C:\WINDOWS\system32\vssapi.dll
2004-08-04 07:56:46 42,496 —-a-w C:\WINDOWS\system32\wsnmp32.dll
2004-08-04 07:56:46 406,528 —-a-w C:\WINDOWS\system32\usp10.dll
2004-08-04 07:56:46 385,536 —-a-w C:\WINDOWS\system32\themeui.dll
2004-08-04 07:56:46 378,368 —-a-w C:\WINDOWS\system32\wzcdlg.dll
2004-08-04 07:56:46 359,936 —-a-w C:\WINDOWS\system32\wzcsvc.dll
2004-08-04 07:56:46 358,400 —-a-w C:\WINDOWS\system32\termmgr.dll
2004-08-04 07:56:46 351,232 —-a-w C:\WINDOWS\system32\winhttp.dll
2004-08-04 07:56:46 35,840 —-a-w C:\WINDOWS\system32\umandlg.dll
2004-08-04 07:56:46 337,920 —-a-w C:\WINDOWS\system32\zipfldr.dll
2004-08-04 07:56:46 32,768 —-a-w C:\WINDOWS\system32\winipsec.dll
2004-08-04 07:56:46 316,416 —-a-w C:\WINDOWS\system32\untfs.dll
2004-08-04 07:56:46 303,616 —-a-w C:\WINDOWS\system32\wmstream.dll
2004-08-04 07:56:46 30,749 —-a-w C:\WINDOWS\system32\vbajet32.dll
2004-08-04 07:56:46 295,424 —-a-w C:\WINDOWS\system32\termsrv.dll
2004-08-04 07:56:46 28,672 —-a-w C:\WINDOWS\system32\wshcon.dll
2004-08-04 07:56:46 275,456 —-a-w C:\WINDOWS\system32\ulib.dll
2004-08-04 07:56:46 264,192 —-a-w C:\WINDOWS\system32\wow32.dll
2004-08-04 07:56:46 26,112 —-a-w C:\WINDOWS\system32\vdmdbg.dll
2004-08-04 07:56:46 25,600 —-a-w C:\WINDOWS\system32\udhisapi.dll
2004-08-04 07:56:46 239,616 —-a-w C:\WINDOWS\system32\upnpui.dll
2004-08-04 07:56:46 233,472 —-a-w C:\WINDOWS\system32\wmpdxm.dll
2004-08-04 07:56:46 221,184 —-a-w C:\WINDOWS\system32\wmpns.dll
2004-08-04 07:56:46 22,528 —-a-w C:\WINDOWS\system32\wsock32.dll
2004-08-04 07:56:46 218,624 —-a-w C:\WINDOWS\system32\uxtheme.dll
2004-08-04 07:56:46 20,480 —-a-w C:\WINDOWS\system32\wmpui.dll
2004-08-04 07:56:46 20,480 —-a-w C:\WINDOWS\system32\wmpcore.dll
2004-08-04 07:56:46 20,480 —-a-w C:\WINDOWS\system32\wmpcd.dll
2004-08-04 07:56:46 191,488 —-a-w C:\WINDOWS\system32\syncui.dll
2004-08-04 07:56:46 19,968 —-a-w C:\WINDOWS\system32\wshtcpip.dll
2004-08-04 07:56:46 19,968 —-a-w C:\WINDOWS\system32\ws2help.dll
2004-08-04 07:56:46 181,760 —-a-w C:\WINDOWS\system32\tapi32.dll
2004-08-04 07:56:46 18,944 —-a-w C:\WINDOWS\system32\version.dll
2004-08-04 07:56:46 18,432 —-a-w C:\WINDOWS\system32\wtsapi32.dll
2004-08-04 07:56:46 176,640 —-a-w C:\WINDOWS\system32\wintrust.dll
2004-08-04 07:56:46 176,128 —-a-w C:\WINDOWS\system32\winmm.dll
2004-08-04 07:56:46 174,592 —-a-w C:\WINDOWS\system32\w32time.dll
2004-08-04 07:56:46 172,032 —-a-w C:\WINDOWS\system32\wldap32.dll
2004-08-04 07:56:46 17,408 ——w C:\WINDOWS\system32\winshfhc.dll
2004-08-04 07:56:46 16,896 —-a-w C:\WINDOWS\system32\winrnr.dll
2004-08-04 07:56:46 16,896 —-a-w C:\WINDOWS\system32\usbmon.dll
2004-08-04 07:56:46 15,872 ——w C:\WINDOWS\system32\w3ssl.dll
2004-08-04 07:56:46 14,848 —-a-w C:\WINDOWS\system32\tcpmib.dll
2004-08-04 07:56:46 14,336 —-a-w C:\WINDOWS\system32\wship6.dll
2004-08-04 07:56:46 135,680 —-a-w C:\WINDOWS\system32\webvw.dll
2004-08-04 07:56:46 132,608 —-a-w C:\WINDOWS\system32\upnp.dll
2004-08-04 07:56:46 13,824 —-a-w C:\WINDOWS\system32\uniplat.dll
2004-08-04 07:56:46 129,536 ——w C:\WINDOWS\system32\xmlprov.dll
2004-08-04 07:56:46 124,416 —-a-w C:\WINDOWS\system32\wiadss.dll
2004-08-04 07:56:46 115,200 —-a-w C:\WINDOWS\system32\wmsdmoe.dll
2004-08-04 07:56:46 114,688 —-a-w C:\WINDOWS\system32\wmpasf.dll
2004-08-04 07:56:46 111,104 —-a-w C:\WINDOWS\system32\wiavideo.dll
2004-08-04 07:56:46 11,776 —-a-w C:\WINDOWS\system32\wshrm.dll
2004-08-04 07:56:46 108,032 ——w C:\WINDOWS\system32\wshbth.dll
2004-08-04 07:56:46 102,400 —-a-w C:\WINDOWS\system32\wmpshell.dll
2004-08-04 07:56:46 101,888 —-a-w C:\WINDOWS\system32\win32spl.dll
2004-08-04 07:56:45 98,304 —-a-w C:\WINDOWS\system32\slbiop.dll
2004-08-04 07:56:45 75,776 ——w C:\WINDOWS\system32\strmfilt.dll
2004-08-04 07:56:45 74,752 —-a-w C:\WINDOWS\system32\storprop.dll
2004-08-04 07:56:45 74,752 —-a-w C:\WINDOWS\system32\spoolss.dll
2004-08-04 07:56:45 73,832 ——w C:\WINDOWS\system32\slcoinst.dll
2004-08-04 07:56:45 71,680 —-a-w C:\WINDOWS\system32\ssdpsrv.dll
2004-08-04 07:56:45 68,096 —-a-w C:\WINDOWS\system32\shgina.dll
2004-08-04 07:56:45 67,584 —-a-w C:\WINDOWS\system32\sti.dll
2004-08-04 07:56:45 67,584 —-a-w C:\WINDOWS\system32\srclient.dll
2004-08-04 07:56:45 65,536 —-a-w C:\WINDOWS\system32\shimeng.dll
2004-08-04 07:56:45 442,368 —-a-w C:\WINDOWS\system32\sqlsrv32.dll
2004-08-04 07:56:45 438,272 —-a-w C:\WINDOWS\system32\shimgvw.dll
2004-08-04 07:56:45 363,008 —-a-w C:\WINDOWS\system32\smlogcfg.dll
2004-08-04 07:56:45 34,816 —-a-w C:\WINDOWS\system32\ssdpapi.dll
2004-08-04 07:56:45 286,792 ——w C:\WINDOWS\system32\slextspk.dll
2004-08-04 07:56:45 27,648 —-a-w C:\WINDOWS\system32\shscrap.dll
2004-08-04 07:56:45 25,088 —-a-w C:\WINDOWS\system32\slayerxp.dll
2004-08-04 07:56:45 25,088 —-a-w C:\WINDOWS\system32\shfolder.dll
2004-08-04 07:56:45 239,104 —-a-w C:\WINDOWS\system32\srrstr.dll
2004-08-04 07:56:45 188,508 ——w C:\WINDOWS\system32\slgen.dll
2004-08-04 07:56:45 182,272 —-a-w C:\WINDOWS\system32\snmpsnap.dll
2004-08-04 07:56:45 180,800 —-a-w C:\WINDOWS\system32\sqlunirl.dll
2004-08-04 07:56:45 18,944 —-a-w C:\WINDOWS\system32\snmpapi.dll
2004-08-04 07:56:45 170,496 —-a-w C:\WINDOWS\system32\srsvc.dll
2004-08-04 07:56:45 151,552 —-a-w C:\WINDOWS\system32\shmedia.dll
2004-08-04 07:56:45 136,704 —-a-w C:\WINDOWS\system32\sti_ci.dll
2004-08-04 07:56:45 13,312 —-a-w C:\WINDOWS\system32\sigtab.dll
2004-08-04 07:56:45 121,856 —-a-w C:\WINDOWS\system32\stobject.dll
2004-08-04 07:56:45 1,580,544 —-a-w C:\WINDOWS\system32\sfcfiles.dll
2004-08-04 07:56:44 96,768 —-a-w C:\WINDOWS\system32\psbase.dll
2004-08-04 07:56:44 91,136 —-a-w C:\WINDOWS\system32\ntprint.dll
2004-08-04 07:56:44 90,624 —-a-w C:\WINDOWS\system32\mydocs.dll
2004-08-04 07:56:44 89,088 —-a-w C:\WINDOWS\system32\rasauto.dll
2004-08-04 07:56:44 88,064 ——w C:\WINDOWS\system32\p2pnetsh.dll
2004-08-04 07:56:44 875,008 —-a-w C:\WINDOWS\system32\netplwiz.dll
2004-08-04 07:56:44 86,016 ——w C:\WINDOWS\system32\p2pgasvc.dll
2004-08-04 07:56:44 831,519 —-a-w C:\WINDOWS\system32\mswdat10.dll
2004-08-04 07:56:44 83,456 —-a-w C:\WINDOWS\system32\olepro32.dll
2004-08-04 07:56:44 80,896 —-a-w C:\WINDOWS\system32\netui0.dll
2004-08-04 07:56:44 8,192 —-a-w C:\WINDOWS\system32\ntlsapi.dll
2004-08-04 07:56:44 713,728 —-a-w C:\WINDOWS\system32\opengl32.dll
2004-08-04 07:56:44 701,440 —-a-w C:\WINDOWS\system32\msxml2.dll
2004-08-04 07:56:44 69,632 —-a-w C:\WINDOWS\system32\scarddlg.dll
2004-08-04 07:56:44 69,632 —-a-w C:\WINDOWS\system32\raschap.dll
2004-08-04 07:56:44 67,584 —-a-w C:\WINDOWS\system32\osuninst.dll
2004-08-04 07:56:44 67,072 —-a-w C:\WINDOWS\system32\ntdsapi.dll
2004-08-04 07:56:44 657,920 —-a-w C:\WINDOWS\system32\rasdlg.dll
2004-08-04 07:56:44 65,536 —-a-w C:\WINDOWS\system32\odbccu32.dll
2004-08-04 07:56:44 65,536 —-a-w C:\WINDOWS\system32\odbccr32.dll
2004-08-04 07:56:44 64,000 —-a-w C:\WINDOWS\system32\samlib.dll
2004-08-04 07:56:44 622,080 —-a-w C:\WINDOWS\system32\netcfgx.dll
2004-08-04 07:56:44 62,976 —-a-w C:\WINDOWS\system32\pautoenr.dll
2004-08-04 07:56:44 614,429 —-a-w C:\WINDOWS\system32\mswstr10.dll
2004-08-04 07:56:44 61,440 —-a-w C:\WINDOWS\system32\rasman.dll
2004-08-04 07:56:44 60,416 —-a-w C:\WINDOWS\system32\remotepg.dll
2004-08-04 07:56:44 6,656 —-a-w C:\WINDOWS\system32\sensapi.dll
2004-08-04 07:56:44 59,904 —-a-w C:\WINDOWS\system32\regsvc.dll
2004-08-04 07:56:44 581,120 —-a-w C:\WINDOWS\system32\rpcrt4.dll
2004-08-04 07:56:44 58,880 —-a-w C:\WINDOWS\system32\resutils.dll
2004-08-04 07:56:44 58,880 —-a-w C:\WINDOWS\system32\rastapi.dll
2004-08-04 07:56:44 562,176 —-a-w C:\WINDOWS\system32\qedit.dll
2004-08-04 07:56:44 560,640 —-a-w C:\WINDOWS\system32\printui.dll
2004-08-04 07:56:44 56,320 —-a-w C:\WINDOWS\system32\servdeps.dll
2004-08-04 07:56:44 553,472 —-a-w C:\WINDOWS\system32\oleaut32.dll
2004-08-04 07:56:44 55,808 —-a-w C:\WINDOWS\system32\secur32.dll
2004-08-04 07:56:44 55,296 —-a-w C:\WINDOWS\system32\sendmail.dll
2004-08-04 07:56:44 54,784 —-a-w C:\WINDOWS\system32\npptools.dll
2004-08-04 07:56:44 526,848 ——w C:\WINDOWS\system32\p2psvc.dll
2004-08-04 07:56:44 506,368 —-a-w C:\WINDOWS\system32\msxml.dll
2004-08-04 07:56:44 5,632 —-a-w C:\WINDOWS\system32\security.dll
2004-08-04 07:56:44 5,120 —-a-w C:\WINDOWS\system32\sfc.dll
2004-08-04 07:56:44 49,664 —-a-w C:\WINDOWS\system32\regapi.dll
2004-08-04 07:56:44 488,448 —-a-w C:\WINDOWS\system32\ntmsmgr.dll
2004-08-04 07:56:44 48,640 ——w C:\WINDOWS\system32\pnrpnsp.dll

coheedKid

Post #6May 27, 2007, 4:11 PM UTC

2004-08-04 07:56:44 45,568 —-a-w C:\WINDOWS\system32\safrslv.dll 2004-08-04 07:56:44 44,032 —-a-w C:\WINDOWS\system32\rtutils.dll 2004-08-04 07:56:44 435,200 —-a-w C:\WINDOWS\system32\ntmssvc.dll 2004-08-04 07:56:44 43,520 —-a-w C:\WINDOWS\system32\safrcdlg.dll 2004-08-04 07:56:44 43,520 —-a-w C:\WINDOWS\system32\racpldlg.dll 2004-08-04 07:56:44 43,520 —-a-w C:\WINDOWS\system32\pstorec.dll 2004-08-04 07:56:44 43,520 —-a-w C:\WINDOWS\system32\ntlanman.dll 2004-08-04 07:56:44 415,744 —-a-w C:\WINDOWS\system32\samsrv.dll 2004-08-04 07:56:44 407,040 —-a-w C:\WINDOWS\system32\netlogon.dll 2004-08-04 07:56:44 40,960 —-a-w C:\WINDOWS\system32\ntmsapi.dll 2004-08-04 07:56:44 397,824 —-a-w C:\WINDOWS\system32\regwizc.dll 2004-08-04 07:56:44 397,056 —-a-w C:\WINDOWS\system32\s3gnb.dll 2004-08-04 07:56:44 39,936 —-a-w C:\WINDOWS\system32\rshx32.dll 2004-08-04 07:56:44 39,936 —-a-w C:\WINDOWS\system32\perfctrs.dll 2004-08-04 07:56:44 385,024 —-a-w C:\WINDOWS\system32\qdvd.dll 2004-08-04 07:56:44 382,464 —-a-w C:\WINDOWS\system32\qmgr.dll 2004-08-04 07:56:44 38,912 —-a-w C:\WINDOWS\system32\sens.dll 2004-08-04 07:56:44 363,520 —-a-w C:\WINDOWS\system32\psisdecd.dll 2004-08-04 07:56:44 36,352 —-a-w C:\WINDOWS\system32\ncobjapi.dll 2004-08-04 07:56:44 35,328 —-a-w C:\WINDOWS\system32\pid.dll 2004-08-04 07:56:44 348,189 —-a-w C:\WINDOWS\system32\msxbde40.dll 2004-08-04 07:56:44 34,816 —-a-w C:\WINDOWS\system32\perfproc.dll 2004-08-04 07:56:44 34,304 —-a-w C:\WINDOWS\system32\pstorsvc.dll 2004-08-04 07:56:44 313,856 —-a-w C:\WINDOWS\system32\scesrv.dll 2004-08-04 07:56:44 312,320 ——w C:\WINDOWS\system32\p2pgraph.dll 2004-08-04 07:56:44 31,744 —-a-w C:\WINDOWS\system32\rtipxmib.dll 2004-08-04 07:56:44 29,696 —-a-w C:\WINDOWS\system32\safrdm.dll 2004-08-04 07:56:44 29,184 —-a-w C:\WINDOWS\system32\sendcmsg.dll 2004-08-04 07:56:44 29,184 ——w C:\WINDOWS\system32\sdhcinst.dll 2004-08-04 07:56:44 285,696 —-a-w C:\WINDOWS\system32\objsel.dll 2004-08-04 07:56:44 283,648 —-a-w C:\WINDOWS\system32\pdh.dll 2004-08-04 07:56:44 28,672 —-a-w C:\WINDOWS\system32\nmmkcert.dll 2004-08-04 07:56:44 279,040 —-a-w C:\WINDOWS\system32\qdv.dll 2004-08-04 07:56:44 278,559 —-a-w C:\WINDOWS\system32\odbcjt32.dll 2004-08-04 07:56:44 270,848 —-a-w C:\WINDOWS\system32\sbe.dll 2004-08-04 07:56:44 27,648 —-a-w C:\WINDOWS\system32\profmap.dll 2004-08-04 07:56:44 266,752 —-a-w C:\WINDOWS\system32\oakley.dll 2004-08-04 07:56:44 26,624 —-a-w C:\WINDOWS\system32\perfdisk.dll 2004-08-04 07:56:44 25,088 —-a-w C:\WINDOWS\system32\perfos.dll 2004-08-04 07:56:44 249,856 —-a-w C:\WINDOWS\system32\odbc32.dll 2004-08-04 07:56:44 248,832 —-a-w C:\WINDOWS\system32\newdev.dll 2004-08-04 07:56:44 245,760 —-a-w C:\WINDOWS\system32\netui1.dll 2004-08-04 07:56:44 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll 2004-08-04 07:56:44 24,576 —-a-w C:\WINDOWS\system32\odbcbcp.dll 2004-08-04 07:56:44 236,544 —-a-w C:\WINDOWS\system32\rasapi32.dll 2004-08-04 07:56:44 23,040 —-a-w C:\WINDOWS\system32\psapi.dll 2004-08-04 07:56:44 206,336 —-a-w C:\WINDOWS\system32\rasppp.dll 2004-08-04 07:56:44 204,288 —-a-w C:\WINDOWS\system32\mswebdvd.dll 2004-08-04 07:56:44 20,992 —-a-w C:\WINDOWS\system32\sclgntfy.dll 2004-08-04 07:56:44 20,511 —-a-w C:\WINDOWS\system32\odtext32.dll 2004-08-04 07:56:44 20,511 —-a-w C:\WINDOWS\system32\oddbse32.dll 2004-08-04 07:56:44 20,510 —-a-w C:\WINDOWS\system32\odpdx32.dll 2004-08-04 07:56:44 20,510 —-a-w C:\WINDOWS\system32\odfox32.dll 2004-08-04 07:56:44 20,510 —-a-w C:\WINDOWS\system32\odexl32.dll 2004-08-04 07:56:44 192,512 —-a-w C:\WINDOWS\system32\qcap.dll 2004-08-04 07:56:44 190,976 —-a-w C:\WINDOWS\system32\schedsvc.dll 2004-08-04 07:56:44 19,968 —-a-w C:\WINDOWS\system32\rdpsnd.dll 2004-08-04 07:56:44 180,224 —-a-w C:\WINDOWS\system32\scecli.dll 2004-08-04 07:56:44 18,944 —-a-w C:\WINDOWS\system32\seclogon.dll 2004-08-04 07:56:44 18,944 —-a-w C:\WINDOWS\system32\rsmps.dll 2004-08-04 07:56:44 18,944 —-a-w C:\WINDOWS\system32\qmgrprxy.dll 2004-08-04 07:56:44 18,944 —-a-w C:\WINDOWS\system32\nddenb32.dll 2004-08-04 07:56:44 179,712 —-a-w C:\WINDOWS\system32\ntmsdba.dll 2004-08-04 07:56:44 176,128 —-a-w C:\WINDOWS\system32\photowiz.dll 2004-08-04 07:56:44 171,008 —-a-w C:\WINDOWS\system32\sccsccp.dll 2004-08-04 07:56:44 17,920 —-a-w C:\WINDOWS\system32\nddeapi.dll 2004-08-04 07:56:44 17,408 —-a-w C:\WINDOWS\system32\powrprof.dll 2004-08-04 07:56:44 17,408 —-a-w C:\WINDOWS\system32\msyuv.dll 2004-08-04 07:56:44 16,896 —-a-w C:\WINDOWS\system32\rassapi.dll 2004-08-04 07:56:44 16,384 —-a-w C:\WINDOWS\system32\odbc32gt.dll 2004-08-04 07:56:44 159,744 —-a-w C:\WINDOWS\system32\scrobj.dll 2004-08-04 07:56:44 159,232 —-a-w C:\WINDOWS\system32\sbeio.dll 2004-08-04 07:56:44 151,552 —-a-w C:\WINDOWS\system32\scrrun.dll 2004-08-04 07:56:44 15,360 —-a-w C:\WINDOWS\system32\pjlmon.dll 2004-08-04 07:56:44 147,968 —-a-w C:\WINDOWS\system32\rdchost.dll 2004-08-04 07:56:44 147,456 —-a-w C:\WINDOWS\system32\odbctrac.dll 2004-08-04 07:56:44 144,896 —-a-w C:\WINDOWS\system32\schannel.dll 2004-08-04 07:56:44 143,872 —-a-w C:\WINDOWS\system32\ntshrui.dll 2004-08-04 07:56:44 140,288 —-a-w C:\WINDOWS\system32\sfc_os.dll 2004-08-04 07:56:44 139,264 —-a-w C:\WINDOWS\system32\netid.dll 2004-08-04 07:56:44 135,168 —-a-w C:\WINDOWS\system32\odbcconf.dll 2004-08-04 07:56:44 120,832 —-a-w C:\WINDOWS\system32\offfilt.dll 2004-08-04 07:56:44 12,288 —-a-w C:\WINDOWS\system32\netrap.dll 2004-08-04 07:56:44 118,784 —-a-w C:\WINDOWS\system32\ntmarta.dll 2004-08-04 07:56:44 116,224 ——w C:\WINDOWS\system32\p2p.dll 2004-08-04 07:56:44 112,128 —-a-w C:\WINDOWS\system32\rastls.dll 2004-08-04 07:56:44 107,008 —-a-w C:\WINDOWS\system32\oleprn.dll 2004-08-04 07:56:44 106,496 —-a-w C:\WINDOWS\system32\odbccp32.dll 2004-08-04 07:56:44 105,472 —-a-w C:\WINDOWS\system32\polstore.dll 2004-08-04 07:56:44 103,936 —-a-w C:\WINDOWS\system32\nlhtml.dll 2004-08-04 07:56:44 102,400 —-a-w C:\WINDOWS\system32\rcbdyctl.dll 2004-08-04 07:56:44 1,737,856 ——w C:\WINDOWS\system32\mtxparhd.dll 2004-08-04 07:56:44 1,708,032 —-a-w C:\WINDOWS\system32\netshell.dll 2004-08-04 07:56:43 994,304 —-a-w C:\WINDOWS\system32\msgina.dll 2004-08-04 07:56:43 72,704 —-a-w C:\WINDOWS\system32\msw3prt.dll 2004-08-04 07:56:43 6,656 —-a-w C:\WINDOWS\system32\msidle.dll 2004-08-04 07:56:43 58,880 —-a-w C:\WINDOWS\system32\msdtclog.dll 2004-08-04 07:56:43 552,989 —-a-w C:\WINDOWS\system32\msrepl40.dll 2004-08-04 07:56:43 54,784 —-a-w C:\WINDOWS\system32\msvcirt.dll 2004-08-04 07:56:43 53,279 —-a-w C:\WINDOWS\system32\msjter40.dll 2004-08-04 07:56:43 512,029 —-a-w C:\WINDOWS\system32\msexch40.dll 2004-08-04 07:56:43 51,712 —-a-w C:\WINDOWS\system32\msident.dll 2004-08-04 07:56:43 421,919 —-a-w C:\WINDOWS\system32\msrd2x40.dll 2004-08-04 07:56:43 413,696 —-a-w C:\WINDOWS\system32\msvcp60.dll 2004-08-04 07:56:43 4,608 —-a-w C:\WINDOWS\system32\msimg32.dll 2004-08-04 07:56:43 348,189 —-a-w C:\WINDOWS\system32\mspbde40.dll 2004-08-04 07:56:43 343,040 —-a-w C:\WINDOWS\system32\msvcrt.dll 2004-08-04 07:56:43 33,792 —-a-w C:\WINDOWS\system32\msgsvc.dll 2004-08-04 07:56:43 319,517 —-a-w C:\WINDOWS\system32\msexcl40.dll 2004-08-04 07:56:43 315,423 —-a-w C:\WINDOWS\system32\msrd3x40.dll 2004-08-04 07:56:43 30,208 —-a-w C:\WINDOWS\system32\mspatcha.dll 2004-08-04 07:56:43 290,816 —-a-w C:\WINDOWS\system32\msnsspc.dll 2004-08-04 07:56:43 274,944 —-a-w C:\WINDOWS\system32\mstask.dll 2004-08-04 07:56:43 258,077 —-a-w C:\WINDOWS\system32\mstext40.dll 2004-08-04 07:56:43 252,928 —-a-w C:\WINDOWS\system32\msoeacct.dll 2004-08-04 07:56:43 25,088 —-a-w C:\WINDOWS\system32\mslbui.dll 2004-08-04 07:56:43 248,832 —-a-w C:\WINDOWS\system32\msieftp.dll 2004-08-04 07:56:43 241,693 —-a-w C:\WINDOWS\system32\msjtes40.dll 2004-08-04 07:56:43 213,023 —-a-w C:\WINDOWS\system32\msltus40.dll 2004-08-04 07:56:43 195,072 —-a-w C:\WINDOWS\system32\msutb.dll 2004-08-04 07:56:43 159,232 —-a-w C:\WINDOWS\system32\msimtf.dll 2004-08-04 07:56:43 151,583 —-a-w C:\WINDOWS\system32\msjint40.dll 2004-08-04 07:56:43 151,552 —-a-w C:\WINDOWS\system32\msdart.dll 2004-08-04 07:56:43 143,360 —-a-w C:\WINDOWS\system32\msorcl32.dll 2004-08-04 07:56:43 14,336 —-a-w C:\WINDOWS\system32\msdmo.dll 2004-08-04 07:56:43 134,656 —-a-w C:\WINDOWS\system32\mssap.dll 2004-08-04 07:56:43 129,536 —-a-w C:\WINDOWS\system32\msv1_0.dll 2004-08-04 07:56:43 120,832 —-a-w C:\WINDOWS\system32\msvfw32.dll 2004-08-04 07:56:43 115,712 —-a-w C:\WINDOWS\system32\mstlsapi.dll 2004-08-04 07:56:43 11,264 —-a-w C:\WINDOWS\system32\msrle32.dll 2004-08-04 07:56:43 105,984 —-a-w C:\WINDOWS\system32\msoert2.dll 2004-08-04 07:56:43 1,507,356 —-a-w C:\WINDOWS\system32\msjet40.dll 2004-08-04 07:56:43 1,428,480 —-a-w C:\WINDOWS\system32\msvidctl.dll 2004-08-04 07:56:43 1,392,671 —-a-w C:\WINDOWS\system32\msvbvm60.dll 2004-08-04 07:56:42 97,280 —-a-w C:\WINDOWS\system32\loadperf.dll 2004-08-04 07:56:42 92,672 —-a-w C:\WINDOWS\system32\dskquota.dll 2004-08-04 07:56:42 87,552 —-a-w C:\WINDOWS\system32\fldrclnr.dll 2004-08-04 07:56:42 87,040 —-a-w C:\WINDOWS\system32\mprapi.dll 2004-08-04 07:56:42 86,016 —-a-w C:\WINDOWS\system32\msapsspc.dll 2004-08-04 07:56:42 86,016 ——w C:\WINDOWS\system32\mdmxsdk.dll 2004-08-04 07:56:42 84,480 —-a-w C:\WINDOWS\system32\mciavi32.dll 2004-08-04 07:56:42 82,432 —-a-w C:\WINDOWS\system32\dmscript.dll 2004-08-04 07:56:42 81,920 —-a-w C:\WINDOWS\system32\isign32.dll 2004-08-04 07:56:42 81,920 —-a-w C:\WINDOWS\system32\ils.dll 2004-08-04 07:56:42 80,384 —-a-w C:\WINDOWS\system32\iccvid.dll 2004-08-04 07:56:42 80,384 —-a-w C:\WINDOWS\system32\faultrep.dll 2004-08-04 07:56:42 8,704 —-a-w C:\WINDOWS\system32\fxsperf.dll 2004-08-04 07:56:42 8,704 —-a-w C:\WINDOWS\system32\dciman32.dll 2004-08-04 07:56:42 8,192 —-a-w C:\WINDOWS\system32\igmpagnt.dll 2004-08-04 07:56:42 755,200 —-a-w C:\WINDOWS\system32\ir50_32.dll 2004-08-04 07:56:42 75,264 —-a-w C:\WINDOWS\system32\inetpp.dll 2004-08-04 07:56:42 73,728 —-a-w C:\WINDOWS\system32\icwdial.dll 2004-08-04 07:56:42 72,192 —-a-w C:\WINDOWS\system32\fxscom.dll 2004-08-04 07:56:42 71,680 —-a-w C:\WINDOWS\system32\msacm32.dll 2004-08-04 07:56:42 71,680 —-a-w C:\WINDOWS\system32\dsdmoprp.dll 2004-08-04 07:56:42 70,656 —-a-w C:\WINDOWS\system32\mmcbase.dll 2004-08-04 07:56:42 7,168 —-a-w C:\WINDOWS\system32\hccoin.dll 2004-08-04 07:56:42 69,632 —-a-w C:\WINDOWS\system32\msconf.dll 2004-08-04 07:56:42 69,120 —-a-w C:\WINDOWS\system32\msctfp.dll 2004-08-04 07:56:42 68,608 —-a-w C:\WINDOWS\system32\digest.dll 2004-08-04 07:56:42 65,536 —-a-w C:\WINDOWS\system32\icwphbk.dll 2004-08-04 07:56:42 640,000 —-a-w C:\WINDOWS\system32\dbghelp.dll 2004-08-04 07:56:42 619,008 —-a-w C:\WINDOWS\system32\dx7vb.dll 2004-08-04 07:56:42 614,912 —-a-w C:\WINDOWS\system32\h323msp.dll 2004-08-04 07:56:42 61,440 —-a-w C:\WINDOWS\system32\dmcompos.dll 2004-08-04 07:56:42 60,928 —-a-w C:\WINDOWS\system32\miglibnt.dll 2004-08-04 07:56:42 60,928 —-a-w C:\WINDOWS\system32\dpnhupnp.dll 2004-08-04 07:56:42 60,416 ——w C:\WINDOWS\system32\fwcfg.dll 2004-08-04 07:56:42 59,904 —-a-w C:\WINDOWS\system32\mpr.dll 2004-08-04 07:56:42 59,904 —-a-w C:\WINDOWS\system32\ipv6mon.dll 2004-08-04 07:56:42 59,904 —-a-w C:\WINDOWS\system32\devenum.dll 2004-08-04 07:56:42 586,240 —-a-w C:\WINDOWS\system32\mlang.dll 2004-08-04 07:56:42 58,880 —-a-w C:\WINDOWS\system32\licwmi.dll 2004-08-04 07:56:42 57,344 —-a-w C:\WINDOWS\system32\msasn1.dll 2004-08-04 07:56:42 57,344 —-a-w C:\WINDOWS\system32\dpwsockx.dll 2004-08-04 07:56:42 562,176 —-a-w C:\WINDOWS\system32\fxsst.dll 2004-08-04 07:56:42 55,808 —-a-w C:\WINDOWS\system32\eventlog.dll 2004-08-04 07:56:42 55,296 —-a-w C:\WINDOWS\system32\fxsevent.dll 2004-08-04 07:56:42 54,272 —-a-w C:\WINDOWS\system32\ixsso.dll 2004-08-04 07:56:42 54,272 —-a-w C:\WINDOWS\system32\dataclen.dll 2004-08-04 07:56:42 52,224 —-a-w C:\WINDOWS\system32\dmutil.dll 2004-08-04 07:56:42 51,200 —-a-w C:\WINDOWS\system32\dssec.dll 2004-08-04 07:56:42 50,688 —-a-w C:\WINDOWS\system32\mmcshext.dll 2004-08-04 07:56:42 48,128 —-a-w C:\WINDOWS\system32\docprop2.dll 2004-08-04 07:56:42 47,616 —-a-w C:\WINDOWS\system32\iyuv_32.dll 2004-08-04 07:56:42 452,096 —-a-w C:\WINDOWS\system32\fxsapi.dll 2004-08-04 07:56:42 45,568 —-a-w C:\WINDOWS\system32\dnsrslvr.dll 2004-08-04 07:56:42 41,984 —-a-w C:\WINDOWS\system32\htui.dll 2004-08-04 07:56:42 400,384 —-a-w C:\WINDOWS\system32\fxsxp32.dll 2004-08-04 07:56:42 4,096 —-a-w C:\WINDOWS\system32\ksuser.dll 2004-08-04 07:56:42 399,872 —-a-w C:\WINDOWS\system32\lmrt.dll 2004-08-04 07:56:42 397,312 —-a-w C:\WINDOWS\system32\fxstiff.dll 2004-08-04 07:56:42 384,512 —-a-w C:\WINDOWS\system32\mp4sdmod.dll 2004-08-04 07:56:42 384,000 —-a-w C:\WINDOWS\system32\ipsmsnap.dll 2004-08-04 07:56:42 382,976 —-a-w C:\WINDOWS\system32\fontext.dll 2004-08-04 07:56:42 380,957 —-a-w C:\WINDOWS\system32\expsrv.dll 2004-08-04 07:56:42 38,912 —-a-w C:\WINDOWS\system32\dfrgsnap.dll 2004-08-04 07:56:42 375,296 —-a-w C:\WINDOWS\system32\dpnet.dll 2004-08-04 07:56:42 367,616 —-a-w C:\WINDOWS\system32\dsound.dll 2004-08-04 07:56:42 36,921 —-a-w C:\WINDOWS\system32\imeshare.dll 2004-08-04 07:56:42 36,864 —-a-w C:\WINDOWS\system32\mscpxl32.dll 2004-08-04 07:56:42 35,840 —-a-w C:\WINDOWS\system32\dmloader.dll 2004-08-04 07:56:42 35,328 —-a-w C:\WINDOWS\system32\mciqtz32.dll 2004-08-04 07:56:42 35,328 —-a-w C:\WINDOWS\system32\dpnhpast.dll 2004-08-04 07:56:42 349,696 —-a-w C:\WINDOWS\system32\ipsecsnp.dll 2004-08-04 07:56:42 344,064 —-a-w C:\WINDOWS\system32\hnetcfg.dll 2004-08-04 07:56:42 341,504 —-a-w C:\WINDOWS\system32\localspl.dll 2004-08-04 07:56:42 34,560 —-a-w C:\WINDOWS\system32\mnmdd.dll 2004-08-04 07:56:42 338,432 —-a-w C:\WINDOWS\system32\ir41_qcx.dll 2004-08-04 07:56:42 337,920 —-a-w C:\WINDOWS\system32\filemgmt.dll 2004-08-04 07:56:42 331,264 —-a-w C:\WINDOWS\system32\ipnathlp.dll 2004-08-04 07:56:42 330,752 —-a-w C:\WINDOWS\system32\ippromon.dll 2004-08-04 07:56:42 330,752 —-a-w C:\WINDOWS\system32\hnetwiz.dll 2004-08-04 07:56:42 33,280 —-a-w C:\WINDOWS\system32\inetmib1.dll 2004-08-04 07:56:42 32,768 —-a-w C:\WINDOWS\system32\isrdbg32.dll 2004-08-04 07:56:42 32,285 ——w C:\WINDOWS\system32\hsfcisp2.dll 2004-08-04 07:56:42 310,272 —-a-w C:\WINDOWS\system32\mp43dmod.dll 2004-08-04 07:56:42 304,128 —-a-w C:\WINDOWS\system32\duser.dll 2004-08-04 07:56:42 294,400 —-a-w C:\WINDOWS\system32\msctf.dll 2004-08-04 07:56:42 285,184 —-a-w C:\WINDOWS\system32\fxscomex.dll 2004-08-04 07:56:42 282,624 —-a-w C:\WINDOWS\system32\devmgr.dll 2004-08-04 07:56:42 28,672 —-a-w C:\WINDOWS\system32\dmband.dll 2004-08-04 07:56:42 28,672 —-a-w C:\WINDOWS\system32\dfsshlex.dll 2004-08-04 07:56:42 28,672 —-a-w C:\WINDOWS\system32\dbnmpntw.dll 2004-08-04 07:56:42 274,432 —-a-w C:\WINDOWS\system32\inetcfg.dll 2004-08-04 07:56:42 27,136 —-a-w C:\WINDOWS\system32\fxsdrv.dll 2004-08-04 07:56:42 27,136 —-a-w C:\WINDOWS\system32\ddrawex.dll 2004-08-04 07:56:42 266,240 —-a-w C:\WINDOWS\system32\ddraw.dll 2004-08-04 07:56:42 246,272 —-a-w C:\WINDOWS\system32\fxst30.dll 2004-08-04 07:56:42 240,640 —-a-w C:\WINDOWS\system32\mpg4dmod.dll 2004-08-04 07:56:42 24,576 —-a-w C:\WINDOWS\system32\dbmsrpcn.dll 2004-08-04 07:56:42 24,576 —-a-w C:\WINDOWS\system32\davclnt.dll 2004-08-04 07:56:42 24,576 ——w C:\WINDOWS\system32\httpapi.dll 2004-08-04 07:56:42 239,104 —-a-w C:\WINDOWS\system32\dsquery.dll 2004-08-04 07:56:42 23,552 —-a-w C:\WINDOWS\system32\mciwave.dll 2004-08-04 07:56:42 23,552 —-a-w C:\WINDOWS\system32\fxsmon.dll 2004-08-04 07:56:42 23,552 —-a-w C:\WINDOWS\system32\fxsext32.dll 2004-08-04 07:56:42 23,552 —-a-w C:\WINDOWS\system32\dpmodemx.dll 2004-08-04 07:56:42 23,552 —-a-w C:\WINDOWS\system32\dmserver.dll 2004-08-04 07:56:42 23,040 —-a-w C:\WINDOWS\system32\mciseq.dll 2004-08-04 07:56:42 23,040 —-a-w C:\WINDOWS\system32\ersvc.dll 2004-08-04 07:56:42 229,888 —-a-w C:\WINDOWS\system32\dplayx.dll 2004-08-04 07:56:42 221,696 —-a-w C:\WINDOWS\system32\localsec.dll 2004-08-04 07:56:42 22,528 —-a-w C:\WINDOWS\system32\mfcsubs.dll 2004-08-04 07:56:42 22,016 —-a-w C:\WINDOWS\system32\lpk.dll 2004-08-04 07:56:42 212,480 —-a-w C:\WINDOWS\system32\dpvoice.dll 2004-08-04 07:56:42 21,504 —-a-w C:\WINDOWS\system32\feclient.dll 2004-08-04 07:56:42 21,504 —-a-w C:\WINDOWS\system32\dpvacm.dll 2004-08-04 07:56:42 207,360 —-a-w C:\WINDOWS\system32\mobsync.dll 2004-08-04 07:56:42 200,704 —-a-w C:\WINDOWS\system32\dmdskmgr.dll 2004-08-04 07:56:42 200,192 —-a-w C:\WINDOWS\system32\ir50_qc.dll 2004-08-04 07:56:42 20,992 —-a-w C:\WINDOWS\system32\hid.dll 2004-08-04 07:56:42 20,480 —-a-w C:\WINDOWS\system32\encapi.dll 2004-08-04 07:56:42 2,113,536 —-a-w C:\WINDOWS\system32\dxdiagn.dll 2004-08-04 07:56:42 192,512 —-a-w C:\WINDOWS\system32\fxswzrd.dll 2004-08-04 07:56:42 19,456 —-a-w C:\WINDOWS\system32\dswave.dll 2004-08-04 07:56:42 186,368 —-a-w C:\WINDOWS\system32\encdec.dll 2004-08-04 07:56:42 183,808 —-a-w C:\WINDOWS\system32\ir50_qcx.dll 2004-08-04 07:56:42 183,296 —-a-w C:\WINDOWS\system32\els.dll 2004-08-04 07:56:42 182,784 —-a-w C:\WINDOWS\system32\ipsecsvc.dll 2004-08-04 07:56:42 181,760 —-a-w C:\WINDOWS\system32\dsdmo.dll 2004-08-04 07:56:42 181,760 —-a-w C:\WINDOWS\system32\dinput8.dll 2004-08-04 07:56:42 181,248 —-a-w C:\WINDOWS\system32\dmime.dll 2004-08-04 07:56:42 18,944 —-a-w C:\WINDOWS\system32\midimap.dll 2004-08-04 07:56:42 17,408 —-a-w C:\WINDOWS\system32\mmfutil.dll 2004-08-04 07:56:42 16,384 —-a-w C:\WINDOWS\system32\ds32gt.dll 2004-08-04 07:56:42 159,232 —-a-w C:\WINDOWS\system32\dinput.dll 2004-08-04 07:56:42 154,112 —-a-w C:\WINDOWS\system32\fxsui.dll 2004-08-04 07:56:42 153,600 —-a-w C:\WINDOWS\system32\modemui.dll 2004-08-04 07:56:42 150,528 —-a-w C:\WINDOWS\system32\keymgr.dll 2004-08-04 07:56:42 15,872 —-a-w C:\WINDOWS\system32\inetppui.dll 2004-08-04 07:56:42 147,456 —-a-w C:\WINDOWS\system32\initpki.dll 2004-08-04 07:56:42 144,896 —-a-w C:\WINDOWS\system32\hotplug.dll 2004-08-04 07:56:42 144,384 —-a-w C:\WINDOWS\system32\imagehlp.dll 2004-08-04 07:56:42 142,336 —-a-w C:\WINDOWS\system32\dsprop.dll 2004-08-04 07:56:42 14,848 —-a-w C:\WINDOWS\system32\mgmtapi.dll 2004-08-04 07:56:42 14,848 —-a-w C:\WINDOWS\system32\mcastmib.dll 2004-08-04 07:56:42 14,336 —-a-w C:\WINDOWS\system32\drprov.dll 2004-08-04 07:56:42 135,680 —-a-w C:\WINDOWS\system32\ifmon.dll 2004-08-04 07:56:42 13,824 —-a-w C:\WINDOWS\system32\lmhsvc.dll 2004-08-04 07:56:42 123,904 —-a-w C:\WINDOWS\system32\dfrgui.dll 2004-08-04 07:56:42 123,392 —-a-w C:\WINDOWS\system32\input.dll 2004-08-04 07:56:42 122,880 —-a-w C:\WINDOWS\system32\glu32.dll 2004-08-04 07:56:42 120,832 —-a-w C:\WINDOWS\system32\idq.dll 2004-08-04 07:56:42 120,320 —-a-w C:\WINDOWS\system32\ir41_qc.dll 2004-08-04 07:56:42 119,808 —-a-w C:\WINDOWS\system32\iasrad.dll 2004-08-04 07:56:42 118,784 ——w C:\WINDOWS\system32\msdadiag.dll 2004-08-04 07:56:42 118,272 —-a-w C:\WINDOWS\system32\mdminst.dll 2004-08-04 07:56:42 116,736 —-a-w C:\WINDOWS\system32\dpvvox.dll 2004-08-04 07:56:42 113,152 —-a-w C:\WINDOWS\system32\dsuiext.dll 2004-08-04 07:56:42 111,104 —-a-w C:\WINDOWS\system32\dgnet.dll 2004-08-04 07:56:42 110,592 —-a-w C:\WINDOWS\system32\dbnetlib.dll 2004-08-04 07:56:42 110,080 —-a-w C:\WINDOWS\system32\imm32.dll 2004-08-04 07:56:42 11,776 —-a-w C:\WINDOWS\system32\localui.dll 2004-08-04 07:56:42 11,264 —-a-w C:\WINDOWS\system32\icaapi.dll 2004-08-04 07:56:42 105,984 —-a-w C:\WINDOWS\system32\dmstyle.dll 2004-08-04 07:56:42 104,448 —-a-w C:\WINDOWS\system32\dmusic.dll 2004-08-04 07:56:42 103,424 —-a-w C:\WINDOWS\system32\dmsynth.dll 2004-08-04 07:56:42 10,240 —-a-w C:\WINDOWS\system32\lprhelp.dll 2004-08-04 07:56:42 1,294,336 —-a-w C:\WINDOWS\system32\dsound3d.dll 2004-08-04 07:56:42 1,227,264 —-a-w C:\WINDOWS\system32\dx8vb.dll 2004-08-04 07:56:42 1,192,960 —-a-w C:\WINDOWS\system32\mmcndmgr.dll 2004-08-04 07:56:42 1,028,096 —-a-w C:\WINDOWS\system32\mfc42.dll 2004-08-04 07:56:41 870,784 ——w C:\WINDOWS\system32\ati3d1ag.dll 2004-08-04 07:56:41 85,504 —-a-w C:\WINDOWS\system32\catsrvps.dll 2004-08-04 07:56:41 84,992 —-a-w C:\WINDOWS\system32\avifil32.dll 2004-08-04 07:56:41 84,480 —-a-w C:\WINDOWS\system32\cabview.dll 2004-08-04 07:56:41 825,344 —-a-w C:\WINDOWS\system32\d3dim700.dll 2004-08-04 07:56:41 8,704 —-a-w C:\WINDOWS\system32\batt.dll 2004-08-04 07:56:41 8,192 —-a-w C:\WINDOWS\system32\d3d8thk.dll 2004-08-04 07:56:41 8,192 —-a-w C:\WINDOWS\system32\bitsprx2.dll 2004-08-04 07:56:41 792,064 —-a-w C:\WINDOWS\system32\comres.dll 2004-08-04 07:56:41 78,336 —-a-w C:\WINDOWS\system32\browsewm.dll 2004-08-04 07:56:41 77,824 —-a-w C:\WINDOWS\system32\cliconfg.dll 2004-08-04 07:56:41 77,312 —-a-w C:\WINDOWS\system32\browser.dll 2004-08-04 07:56:41 74,752 —-a-w C:\WINDOWS\system32\cryptdlg.dll 2004-08-04 07:56:41 70,656 —-a-w C:\WINDOWS\system32\amstream.dll 2004-08-04 07:56:41 7,168 —-a-w C:\WINDOWS\system32\bitsprx3.dll 2004-08-04 07:56:41 68,096 —-a-w C:\WINDOWS\system32\adsmsext.dll 2004-08-04 07:56:41 65,024 —-a-w C:\WINDOWS\system32\asycfilt.dll 2004-08-04 07:56:41 63,488 —-a-w C:\WINDOWS\system32\cryptnet.dll 2004-08-04 07:56:41 616,960 —-a-w C:\WINDOWS\system32\advapi32.dll 2004-08-04 07:56:41 60,416 —-a-w C:\WINDOWS\system32\cryptsvc.dll 2004-08-04 07:56:41 597,504 —-a-w C:\WINDOWS\system32\crypt32.dll 2004-08-04 07:56:41 59,904 —-a-w C:\WINDOWS\system32\cabinet.dll 2004-08-04 07:56:41 58,880 —-a-w C:\WINDOWS\system32\atl.dll 2004-08-04 07:56:41 57,856 —-a-w C:\WINDOWS\system32\clusapi.dll 2004-08-04 07:56:41 53,760 —-a-w C:\WINDOWS\system32\cryptext.dll 2004-08-04 07:56:41 52,736 —-a-w C:\WINDOWS\system32\basesrv.dll 2004-08-04 07:56:41 516,768 ——w C:\WINDOWS\system32\ativvaxx.dll 2004-08-04 07:56:41 512,512 —-a-w C:\WINDOWS\system32\cryptui.dll 2004-08-04 07:56:41 50,688 —-a-w C:\WINDOWS\system32\camocx.dll 2004-08-04 07:56:41 50,688 ——w C:\WINDOWS\system32\btpanui.dll 2004-08-04 07:56:41 47,104 —-a-w C:\WINDOWS\system32\cnbjmon.dll 2004-08-04 07:56:41 457,728 —-a-w C:\WINDOWS\system32\certmgr.dll 2004-08-04 07:56:41 42,496 —-a-w C:\WINDOWS\system32\audiosrv.dll 2004-08-04 07:56:41 39,936 —-a-w C:\WINDOWS\system32\cmutil.dll 2004-08-04 07:56:41 38,912 —-a-w C:\WINDOWS\system32\cfgbkend.dll 2004-08-04 07:56:41 377,984 ——w C:\WINDOWS\system32\ati2dvaa.dll 2004-08-04 07:56:41 343,040 —-a-w C:\WINDOWS\system32\cmdial32.dll 2004-08-04 07:56:41 33,280 —-a-w C:\WINDOWS\system32\cryptdll.dll 2004-08-04 07:56:41 326,656 —-a-w C:\WINDOWS\system32\cscui.dll 2004-08-04 07:56:41 32,768 —-a-w C:\WINDOWS\system32\csrsrv.dll 2004-08-04 07:56:41 32,768 ——w C:\WINDOWS\system32\ativtmxx.dll 2004-08-04 07:56:41 30,208 —-a-w C:\WINDOWS\system32\atmlib.dll 2004-08-04 07:56:41 30,208 ——w C:\WINDOWS\system32\bthserv.dll 2004-08-04 07:56:41 28,672 —-a-w C:\WINDOWS\system32\batmeter.dll 2004-08-04 07:56:41 276,992 —-a-w C:\WINDOWS\system32\comdlg32.dll 2004-08-04 07:56:41 263,680 —-a-w C:\WINDOWS\system32\adsnt.dll 2004-08-04 07:56:41 252,928 —-a-w C:\WINDOWS\system32\compatui.dll 2004-08-04 07:56:41 229,376 —-a-w C:\WINDOWS\system32\compstui.dll 2004-08-04 07:56:41 229,376 ——w C:\WINDOWS\system32\ati2cqag.dll 2004-08-04 07:56:41 201,728 ——w C:\WINDOWS\system32\ati2dvag.dll 2004-08-04 07:56:41 20,992 ——w C:\WINDOWS\system32\bthci.dll 2004-08-04 07:56:41 194,560 —-a-w C:\WINDOWS\system32\certcli.dll 2004-08-04 07:56:41 194,048 —-a-w C:\WINDOWS\system32\activeds.dll 2004-08-04 07:56:41 185,344 —-a-w C:\WINDOWS\system32\cmprops.dll 2004-08-04 07:56:41 175,616 —-a-w C:\WINDOWS\system32\adsldp.dll 2004-08-04 07:56:41 17,408 —-a-w C:\WINDOWS\system32\bidispl.dll 2004-08-04 07:56:41 17,408 —-a-w C:\WINDOWS\system32\alrsvc.dll 2004-08-04 07:56:41 163,840 —-a-w C:\WINDOWS\system32\credui.dll 2004-08-04 07:56:41 15,872 —-a-w C:\WINDOWS\system32\cmcfg32.dll 2004-08-04 07:56:41 143,360 —-a-w C:\WINDOWS\system32\adsldpc.dll 2004-08-04 07:56:41 13,824 ——w C:\WINDOWS\system32\cmsetacl.dll 2004-08-04 07:56:41 126,976 —-a-w C:\WINDOWS\system32\apphelp.dll 2004-08-04 07:56:41 114,688 —-a-w C:\WINDOWS\system32\aclui.dll 2004-08-04 07:56:41 101,888 —-a-w C:\WINDOWS\system32\cscdll.dll 2004-08-04 07:56:41 101,888 —-a-w C:\WINDOWS\system32\actxprxy.dll 2004-08-04 07:56:41 1,888,992 ——w C:\WINDOWS\system32\ati3duag.dll 2004-08-04 07:56:41 1,689,088 —-a-w C:\WINDOWS\system32\d3d9.dll 2004-08-04 07:56:41 1,179,648 —-a-w C:\WINDOWS\system32\d3d8.dll 2004-08-04 07:56:36 708,096 —-a-w C:\WINDOWS\system32\ntdll.dll 2004-08-04 07:56:36 438,784 —-a-w C:\WINDOWS\system32\xpob2res.dll 2004-08-04 07:56:36 2,940,928 —-a-w C:\WINDOWS\system32\wmploc.dll 2004-08-04 07:56:36 2,897,920 —-a-w C:\WINDOWS\system32\xpsp2res.dll 2004-08-04 07:56:36 187,392 —-a-w C:\WINDOWS\system32\xpsp1res.dll 2004-08-04 07:56:35 937,984 —-a-w C:\WINDOWS\system32\winbrand.dll 2004-08-04 07:56:35 764,928 —-a-w C:\WINDOWS\system32\winntbbu.dll 2004-08-04 07:56:35 5,632 —-a-w C:\WINDOWS\system32\wmi.dll 2004-08-04 07:56:35 168,448 —-a-w C:\WINDOWS\system32\wmerror.dll 2004-08-04 07:56:27 549,376 —-a-w C:\WINDOWS\system32\shdoclc.dll 2004-08-04 07:56:24 733,696 —-a-w C:\WINDOWS\system32\qedwipes.dll 2004-08-04 07:56:22 94,208 —-a-w C:\WINDOWS\system32\odbcint.dll 2004-08-04 07:56:22 53,279 —-a-w C:\WINDOWS\system32\odbcji32.dll 2004-08-04 07:56:22 12,288 —-a-w C:\WINDOWS\system32\odbcp32r.dll 2004-08-04 07:56:18 48,128 —-a-w C:\WINDOWS\system32\msprivs.dll 2004-08-04 07:56:18 20,480 —-a-w C:\WINDOWS\system32\msorc32r.dll 2004-08-04 07:56:13 4,126 —-a-w C:\WINDOWS\system32\msdxmlc.dll 2004-08-04 07:56:12 3,584 —-a-w C:\WINDOWS\system32\msafd.dll 2004-08-04 07:56:12 12,288 —-a-w C:\WINDOWS\system32\mscpx32r.dll 2004-08-04 07:56:11 216,064 —-a-w C:\WINDOWS\system32\moricons.dll 2004-08-04 07:56:10 7,680 ——w C:\WINDOWS\system32\kbdsmsno.dll 2004-08-04 07:56:10 7,680 ——w C:\WINDOWS\system32\kbdsmsfi.dll 2004-08-04 07:56:10 7,168 ——w C:\WINDOWS\system32\kbdukx.dll 2004-08-04 07:56:10 7,168 ——w C:\WINDOWS\system32\kbdno1.dll 2004-08-04 07:56:10 7,168 ——w C:\WINDOWS\system32\kbdfi1.dll 2004-08-04 07:56:10 6,656 ——w C:\WINDOWS\system32\kbdinmal.dll 2004-08-04 07:56:10 6,656 ——w C:\WINDOWS\system32\kbdinben.dll 2004-08-04 07:56:10 6,144 ——w C:\WINDOWS\system32\kbdmlt48.dll 2004-08-04 07:56:10 6,144 ——w C:\WINDOWS\system32\kbdmlt47.dll 2004-08-04 07:56:10 6,144 ——w C:\WINDOWS\system32\kbdinbe1.dll 2004-08-04 07:56:10 5,632 ——w C:\WINDOWS\system32\kbdmaori.dll 2004-08-04 07:56:08 48,128 —-a-w C:\WINDOWS\system32\inetres.dll 2004-08-04 07:56:07 9,728 —-a-w C:\WINDOWS\system32\gpkrsrc.dll 2004-08-04 07:56:07 3,584 —-a-w C:\WINDOWS\system32\icmp.dll 2004-08-04 07:56:06 9,344 —-a-w C:\WINDOWS\system32\framebuf.dll 2004-08-04 07:56:06 6,656 —-a-w C:\WINDOWS\system32\fxsres.dll 2004-08-04 07:56:04 4,096 —-a-w C:\WINDOWS\system32\dsprpres.dll 2004-08-04 07:56:03 3,584 —-a-w C:\WINDOWS\system32\dpnlobby.dll 2004-08-04 07:56:03 3,584 —-a-w C:\WINDOWS\system32\dpnaddr.dll 2004-08-04 07:56:00 16,896 —-a-w C:\WINDOWS\system32\cfgmgr32.dll 2004-08-04 07:55:59 8,192 —-a-w C:\WINDOWS\system32\asferror.dll 2004-08-04 07:55:59 63,488 —-a-w C:\WINDOWS\system32\browselc.dll 2004-08-04 07:55:59 285,696 —-a-w C:\WINDOWS\system32\atmfd.dll 2004-08-04 06:56:58 11,776 ——w C:\WINDOWS\system32\spnpinst.exe 2004-08-04 06:56:46 983,552 —-a-w C:\WINDOWS\system32\setupapi.dll 2004-08-04 06:56:44 423,936 —-a-w C:\WINDOWS\system32\licdll.dll 2004-08-04 06:15:55 60,800 —-a-w C:\WINDOWS\system32\drivers\sysaudio.sys 2004-08-04 06:15:52 64,896 —-a-w C:\WINDOWS\system32\drivers\serial.sys 2004-08-04 06:15:49 145,792 —-a-w C:\WINDOWS\system32\drivers\portcls.sys 2004-08-04 06:15:21 140,928 —-a-w C:\WINDOWS\system32\drivers\ks.sys 2004-08-04 06:15:20 107,904 —-a-w C:\WINDOWS\system32\drivers\mup.sys 2004-08-04 06:14:37 162,816 —-a-w C:\WINDOWS\system32\drivers\netbt.sys 2004-08-04 06:14:36 52,736 —-a-w C:\WINDOWS\system32\drivers\i8042prt.sys 2004-08-04 06:14:31 91,776 —-a-w C:\WINDOWS\system32\drivers\ndiswan.sys 2004-08-04 06:14:28 74,752 —-a-w C:\WINDOWS\system32\drivers\ipsec.sys 2004-08-04 06:14:28 182,912 —-a-w C:\WINDOWS\system32\drivers\ndis.sys 2004-08-04 06:14:26 49,664 —-a-w C:\WINDOWS\system32\drivers\classpnp.sys 2004-08-04 06:14:26 48,384 —-a-w C:\WINDOWS\system32\drivers\raspptp.sys 2004-08-04 06:14:22 51,328 —-a-w C:\WINDOWS\system32\drivers\rasl2tp.sys 2004-08-04 06:14:16 143,360 —-a-w C:\WINDOWS\system32\drivers\fastfat.sys 2004-08-04 06:14:14 138,496 —-a-w C:\WINDOWS\system32\drivers\afd.sys 2004-08-04 06:14:10 63,744 —-a-w C:\WINDOWS\system32\drivers\cdfs.sys 2004-08-04 06:13:53 97,280 —-a-w C:\WINDOWS\system32\dpcdll.dll 2004-08-04 06:10:39 59,648 ——w C:\WINDOWS\system32\drivers\rfcomm.sys 2004-08-04 06:10:38 38,016 ——w C:\WINDOWS\system32\drivers\bthmodem.sys 2004-08-04 06:10:38 17,024 ——w C:\WINDOWS\system32\drivers\bthenum.sys 2004-08-04 06:10:37 35,456 ——w C:\WINDOWS\system32\drivers\bthprint.sys 2004-08-04 06:10:37 274,304 ——w C:\WINDOWS\system32\drivers\bthport.sys 2004-08-04 06:10:36 25,600 ——w C:\WINDOWS\system32\drivers\hidbth.sys 2004-08-04 06:10:34 18,944 ——w C:\WINDOWS\system32\drivers\bthusb.sys 2004-08-04 06:10:28 85,376 —-a-w C:\WINDOWS\system32\drivers\nabtsfec.sys 2004-08-04 06:10:21 19,328 —-a-w C:\WINDOWS\system32\drivers\wstcodec.sys 2004-08-04 06:10:16 17,024 —-a-w C:\WINDOWS\system32\drivers\ccdecode.sys 2004-08-04 06:10:16 11,136 —-a-w C:\WINDOWS\system32\drivers\slip.sys 2004-08-04 06:10:12 15,360 —-a-w C:\WINDOWS\system32\drivers\streamip.sys 2004-08-04 06:10:12 15,360 —-a-w C:\WINDOWS\system32\drivers\mpe.sys 2004-08-04 06:10:12 11,776 —-a-w C:\WINDOWS\system32\drivers\bdasup.sys 2004-08-04 06:10:12 10,880 —-a-w C:\WINDOWS\system32\drivers\ndisip.sys 2004-08-04 06:10:10 78,464 ——w C:\WINDOWS\system32\drivers\usbvideo.sys 2004-08-04 06:10:08 61,056 —-a-w C:\WINDOWS\system32\drivers\ohci1394.sys 2004-08-04 06:10:06 53,248 —-a-w C:\WINDOWS\system32\drivers\1394bus.sys 2004-08-04 06:09:58 51,328 —-a-w C:\WINDOWS\system32\drivers\msdv.sys 2004-08-04 06:09:55 25,472 —-a-w C:\WINDOWS\system32\drivers\sonydcam.sys 2004-08-04 06:08:57 16,000 —-a-w C:\WINDOWS\system32\drivers\usbintel.sys 2004-08-04 06:08:46 31,616 —-a-w C:\WINDOWS\system32\drivers\usbccgp.sys 2004-08-04 06:08:42 57,600 —-a-w C:\WINDOWS\system32\drivers\usbhub.sys 2004-08-04 06:08:42 142,976 —-a-w C:\WINDOWS\system32\drivers\usbport.sys 2004-08-04 06:08:37 26,624 —-a-w C:\WINDOWS\system32\drivers\usbehci.sys 2004-08-04 06:08:37 20,480 —-a-w C:\WINDOWS\system32\drivers\usbuhci.sys 2004-08-04 06:08:36 17,024 —-a-w C:\WINDOWS\system32\drivers\usbohci.sys 2004-08-04 06:08:19 36,224 —-a-w C:\WINDOWS\system32\drivers\hidclass.sys 2004-08-04 06:08:18 15,104 ——w C:\WINDOWS\system32\drivers\hidir.sys 2004-08-04 06:08:16 24,960 —-a-w C:\WINDOWS\system32\drivers\hidparse.sys 2004-08-04 06:08:05 30,080 —-a-w C:\WINDOWS\system32\drivers\modem.sys 2004-08-04 06:08:02 48,640 —-a-w C:\WINDOWS\system32\drivers\stream.sys 2004-08-04 06:07:58 60,288 —-a-w C:\WINDOWS\system32\drivers\drmk.sys 2004-08-04 06:07:57 2,944 —-a-w C:\WINDOWS\system32\drivers\drmkaud.sys 2004-08-04 06:07:55 59,264 —-a-w C:\WINDOWS\system32\drivers\usbaudio.sys 2004-08-04 06:07:48 18,560 —-a-w C:\WINDOWS\system32\drivers\tdi.sys 2004-08-04 06:07:47 67,584 ——w C:\WINDOWS\system32\drivers\sdbus.sys 2004-08-04 06:07:47 15,488 ——w C:\WINDOWS\system32\drivers\mssmbios.sys 2004-08-04 06:07:46 68,224 —-a-w C:\WINDOWS\system32\drivers\pci.sys 2004-08-04 06:07:46 119,936 —-a-w C:\WINDOWS\system32\drivers\pcmcia.sys 2004-08-04 06:07:44 63,744 —-a-w C:\WINDOWS\system32\drivers\mf.sys 2004-08-04 06:07:43 46,464 ——w C:\WINDOWS\system32\drivers\gagp30kx.sys 2004-08-04 06:07:43 44,672 ——w C:\WINDOWS\system32\drivers\uagp35.sys 2004-08-04 06:07:42 44,928 ——w C:\WINDOWS\system32\drivers\agpcpq.sys 2004-08-04 06:07:42 43,008 ——w C:\WINDOWS\system32\drivers\amdagp.sys 2004-08-04 06:07:42 42,240 ——w C:\WINDOWS\system32\drivers\viaagp.sys 2004-08-04 06:07:42 41,088 ——w C:\WINDOWS\system32\drivers\sisagp.sys 2004-08-04 06:07:41 42,752 ——w C:\WINDOWS\system32\drivers\alim1541.sys 2004-08-04 06:07:41 42,368 —-a-w C:\WINDOWS\system32\drivers\agp440.sys 2004-08-04 06:07:38 52,864 —-a-w C:\WINDOWS\system32\drivers\dmusic.sys 2004-08-04 06:07:38 187,776 —-a-w C:\WINDOWS\system32\drivers\acpi.sys 2004-08-04 06:07:36 6,016 ——w C:\WINDOWS\system32\drivers\smbali.sys 2004-08-04 06:07:32 17,664 —-a-w C:\WINDOWS\system32\watchdog.sys 2004-08-04 06:07:17 799,744 —-a-w C:\WINDOWS\system32\drivers\dmboot.sys 2004-08-04 06:07:16 153,344 —-a-w C:\WINDOWS\system32\drivers\dmio.sys 2004-08-04 06:07:06 20,992 —-a-w C:\WINDOWS\system32\drivers\vga.sys 2004-08-04 06:07:05 79,744 —-a-w C:\WINDOWS\system32\drivers\videoprt.sys 2004-08-04 06:06:25 73,472 —-a-w C:\WINDOWS\system32\drivers\sr.sys 2004-08-04 06:05:07 41,472 —-a-w C:\WINDOWS\system32\drivers\raspppoe.sys 2004-08-04 06:05:03 14,336 —-a-w C:\WINDOWS\system32\drivers\asyncmac.sys 2004-08-04 06:04:57 34,560 —-a-w C:\WINDOWS\system32\drivers\wanarp.sys 2004-08-04 06:04:52 13,568 ——w C:\WINDOWS\system32\drivers\wacompen.sys 2004-08-04 06:04:51 12,672 ——w C:\WINDOWS\system32\drivers\mutohpen.sys 2004-08-04 06:04:45 20,992 —-a-w C:\WINDOWS\system32\drivers\ipinip.sys 2004-08-04 06:04:41 24,064 —-a-w C:\WINDOWS\system32\pidgen.dll 2004-08-04 06:04:33 12,672 ——w C:\WINDOWS\system32\drivers\usb8023x.sys 2004-08-04 06:04:32 12,672 —-a-w C:\WINDOWS\system32\drivers\usb8023.sys 2004-08-04 06:04:31 30,080 —-a-w C:\WINDOWS\system32\drivers\rndismp.sys 2004-08-04 06:04:31 30,080 ——w C:\WINDOWS\system32\drivers\rndismpx.sys 2004-08-04 06:04:19 69,120 —-a-w C:\WINDOWS\system32\drivers\psched.sys 2004-08-04 06:04:12 35,072 —-a-w C:\WINDOWS\system32\drivers\msgpc.sys 2004-08-04 06:03:35 88,448 —-a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys 2004-08-04 06:03:21 34,560 —-a-w C:\WINDOWS\system32\drivers\netbios.sys 2004-08-04 06:03:17 12,416 —-a-w C:\WINDOWS\system32\drivers\tunmp.sys 2004-08-04 06:03:12 12,928 —-a-w C:\WINDOWS\system32\drivers\ndisuio.sys 2004-08-04 06:01:24 25,856 —-a-w C:\WINDOWS\system32\drivers\usbprint.sys 2004-08-04 06:01:15 196,864 —-a-w C:\WINDOWS\system32\drivers\rdpdr.sys 2004-08-04 06:00:56 181,248 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2004-08-04 06:00:54 71,040 —-a-w C:\WINDOWS\system32\drivers\dxg.sys 2004-08-04 06:00:46 11,264 —-a-w C:\WINDOWS\system32\drivers\irenum.sys 2004-08-04 06:00:43 30,848 —-a-w C:\WINDOWS\system32\drivers\npfs.sys 2004-08-04 06:00:41 19,072 —-a-w C:\WINDOWS\system32\drivers\msfs.sys 2004-08-04 06:00:31 66,176 —-a-w C:\WINDOWS\system32\drivers\udfs.sys 2004-08-04 06:00:16 52,352 —-a-w C:\WINDOWS\system32\drivers\volsnap.sys 2004-08-04 06:00:15 41,856 —-a-w C:\WINDOWS\system32\drivers\imapi.sys 2004-08-04 06:00:06 29,056 ——w C:\WINDOWS\system32\drivers\ip6fw.sys 2004-08-04 05:59:59 14,976 —-a-w C:\WINDOWS\system32\drivers\tape.sys 2004-08-04 05:59:57 71,552 —-a-w C:\WINDOWS\system32\drivers\bridge.sys 2004-08-04 05:59:54 36,352 —-a-w C:\WINDOWS\system32\drivers\disk.sys 2004-08-04 05:59:54 11,392 —-a-w C:\WINDOWS\system32\drivers\sfloppy.sys 2004-08-04 05:59:54 11,136 ——w C:\WINDOWS\system32\drivers\sffdisk.sys 2004-08-04 05:59:54 10,240 ——w C:\WINDOWS\system32\drivers\sffp_sd.sys 2004-08-04 05:59:52 49,536 —-a-w C:\WINDOWS\system32\drivers\cdrom.sys 2004-08-04 05:59:52 14,208 —-a-w C:\WINDOWS\system32\drivers\diskdump.sys 2004-08-04 05:59:50 40,320 —-a-w C:\WINDOWS\system32\drivers\nmnt.sys 2004-08-04 05:59:47 92,032 —-a-w C:\WINDOWS\system32\drivers\ksecdd.sys 2004-08-04 05:59:43 655,360 —-a-w C:\WINDOWS\system32\mstscax.dll 2004-08-04 05:59:42 95,360 —-a-w C:\WINDOWS\system32\drivers\atapi.sys 2004-08-04 05:59:42 5,376 —-a-w C:\WINDOWS\system32\drivers\viaide.sys 2004-08-04 05:59:41 96,256 —-a-w C:\WINDOWS\system32\drivers\scsiport.sys 2004-08-04 05:59:41 5,504 —-a-w C:\WINDOWS\system32\drivers\intelide.sys 2004-08-04 05:59:41 25,088 —-a-w C:\WINDOWS\system32\drivers\pciidex.sys 2004-08-04 05:59:40 407,552 —-a-w C:\WINDOWS\system32\mstsc.exe 2004-08-04 05:59:37 57,472 —-a-w C:\WINDOWS\system32\drivers\redbook.sys 2004-08-04 05:59:27 44,544 —-a-w C:\WINDOWS\system32\tscupgrd.exe 2004-08-04 05:59:27 27,392 —-a-w C:\WINDOWS\system32\drivers\fdc.sys 2004-08-04 05:59:27 20,480 —-a-w C:\WINDOWS\system32\drivers\flpydisk.sys 2004-08-04 05:59:23 7,424 —-a-w C:\WINDOWS\system32\kd1394.dll 2004-08-04 05:59:20 37,376 —-a-w C:\WINDOWS\system32\drivers\amdk7.sys 2004-08-04 05:59:20 36,480 —-a-w C:\WINDOWS\system32\drivers\crusoe.sys 2004-08-04 05:59:19 42,496 —-a-w C:\WINDOWS\system32\drivers\p3.sys 2004-08-04 05:59:19 36,992 —-a-w C:\WINDOWS\system32\drivers\amdk6.sys 2004-08-04 05:59:19 36,096 ——w C:\WINDOWS\system32\drivers\intelppm.sys 2004-08-04 05:59:17 35,328 —-a-w C:\WINDOWS\system32\drivers\processr.sys 2004-08-04 05:59:07 15,488 —-a-w C:\WINDOWS\system32\drivers\serenum.sys 2004-08-04 05:59:06 80,128 —-a-w C:\WINDOWS\system32\drivers\parport.sys 2004-08-04 05:58:41 7,552 —-a-w C:\WINDOWS\system32\drivers\mskssrv.sys 2004-08-04 05:58:41 4,352 —-a-w C:\WINDOWS\system32\drivers\swenum.sys 2004-08-04 05:58:40 4,992 —-a-w C:\WINDOWS\system32\drivers\mspqm.sys 2004-08-04 05:58:38 5,504 —-a-w C:\WINDOWS\system32\drivers\mstee.sys 2004-08-04 05:58:38 5,376 —-a-w C:\WINDOWS\system32\drivers\mspclock.sys 2004-08-04 05:58:38 100,992 ——w C:\WINDOWS\system32\drivers\bthpan.sys 2004-08-04 05:58:34 55,936 —-a-w C:\WINDOWS\system32\drivers\atmlane.sys 2004-08-04 05:58:32 24,576 —-a-w C:\WINDOWS\system32\drivers\kbdclass.sys 2004-08-04 05:58:32 23,040 —-a-w C:\WINDOWS\system32\drivers\mouclass.sys 2004-08-04 05:58:32 209,408 —-a-w C:\WINDOWS\system32\drivers\update.sys 2004-08-04 05:58:30 59,904 —-a-w C:\WINDOWS\system32\drivers\atmarpc.sys 2004-08-04 05:58:30 42,240 —-a-w C:\WINDOWS\system32\drivers\mountmgr.sys 2004-08-04 05:58:29 61,824 —-a-w C:\WINDOWS\system32\drivers\nic1394.sys 2004-08-04 05:58:29 60,800 —-a-w C:\WINDOWS\system32\drivers\arp1394.sys 2004-08-04 05:58:25 61,440 —-a-w C:\WINDOWS\system32\msvcrt40.dll 2004-08-04 05:51:21 53,840 —-a-w C:\WINDOWS\system32\dosx.exe 2004-08-04 05:51:11 68,768 —-a-w C:\WINDOWS\system32\mmsystem.dll 2004-08-04 05:49:32 92,224 —-a-w C:\WINDOWS\system32\krnl386.exe 2004-08-04 05:48:44 3,338 —-a-w C:\WINDOWS\system32\redir.exe 2004-08-04 05:45:15 35,424 —-a-w C:\WINDOWS\system32\ntio412.sys 2004-08-04 05:45:14 34,560 —-a-w C:\WINDOWS\system32\ntio404.sys 2004-08-04 05:45:12 34,560 —-a-w C:\WINDOWS\system32\ntio804.sys 2004-08-04 05:45:10 35,648 —-a-w C:\WINDOWS\system32\ntio411.sys 2004-08-04 05:45:08 33,840 —-a-w C:\WINDOWS\system32\ntio.sys 2004-08-04 05:41:55 11,868 ——w C:\WINDOWS\system32\drivers\mdmxsdk.sys 2004-08-04 05:41:54 1,041,536 ——w C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2004-08-04 05:41:48 685,056 ——w C:\WINDOWS\system32\drivers\hsfcxts2.sys 2004-08-04 05:41:46 220,032 ——w C:\WINDOWS\system32\drivers\hsfbs2s2.sys 2004-08-04 05:41:45 13,240 ——w C:\WINDOWS\system32\drivers\slwdmsup.sys 2004-08-04 05:41:44 95,424 ——w C:\WINDOWS\system32\drivers\slnthal.sys 2004-08-04 05:41:42 404,990 ——w C:\WINDOWS\system32\drivers\slntamr.sys 2004-08-04 05:41:40 129,535 ——w C:\WINDOWS\system32\drivers\slnt7554.sys 2004-08-04 05:41:39 180,360 ——w C:\WINDOWS\system32\drivers\ntmtlfax.sys 2004-08-04 05:41:39 13,776 ——w C:\WINDOWS\system32\drivers\recagent.sys 2004-08-04 05:41:38 126,686 ——w C:\WINDOWS\system32\drivers\mtlmnt5.sys 2004-08-04 05:41:37 1,309,184 ——w C:\WINDOWS\system32\drivers\mtlstrm.sys 2004-08-04 05:31:43 306,176 —-a-w C:\WINDOWS\system32\slbcsp.dll 2004-08-04 05:31:43 152,576 —-a-w C:\WINDOWS\system32\rsaenh.dll 2004-08-04 05:31:43 137,216 —-a-w C:\WINDOWS\system32\dssenh.dll 2004-08-04 05:31:32 20,992 —-a-w C:\WINDOWS\system32\drivers\rtl8139.sys 2004-08-04 05:29:51 166,912 —-a-w C:\WINDOWS\system32\drivers\s3gnbm.sys 2004-08-04 05:29:45 25,471 ——w C:\WINDOWS\system32\drivers\watv10nt.sys 2004-08-04 05:29:44 22,271 ——w C:\WINDOWS\system32\drivers\watv06nt.sys 2004-08-04 05:29:40 11,935 ——w C:\WINDOWS\system32\drivers\wadv11nt.sys 2004-08-04 05:29:40 11,871 ——w C:\WINDOWS\system32\drivers\wadv09nt.sys 2004-08-04 05:29:39 11,295 ——w C:\WINDOWS\system32\drivers\wadv08nt.sys 2004-08-04 05:29:38 11,807 ——w C:\WINDOWS\system32\drivers\wadv07nt.sys 2004-08-04 05:29:36 452,736 ——w C:\WINDOWS\system32\drivers\mtxparhm.sys 2004-08-04 05:29:31 73,216 ——w C:\WINDOWS\system32\drivers\atintuxx.sys 2004-08-04 05:29:31 63,488 ——w C:\WINDOWS\system32\drivers\atinxsxx.sys 2004-08-04 05:29:31 36,463 ——w C:\WINDOWS\system32\drivers\ati1tuxx.sys 2004-08-04 05:29:31 34,735 ——w C:\WINDOWS\system32\drivers\ati1xsxx.sys 2004-08-04 05:29:31 31,744 ——w C:\WINDOWS\system32\drivers\atinxbxx.sys 2004-08-04 05:29:31 29,455 ——w C:\WINDOWS\system32\drivers\ati1xbxx.sys 2004-08-04 05:29:31 26,367 ——w C:\WINDOWS\system32\drivers\ati1snxx.sys 2004-08-04 05:29:31 21,343 ——w C:\WINDOWS\system32\drivers\ati1ttxx.sys 2004-08-04 05:29:30 63,663 ——w C:\WINDOWS\system32\drivers\ati1rvxx.sys 2004-08-04 05:29:30 30,671 ——w C:\WINDOWS\system32\drivers\ati1raxx.sys 2004-08-04 05:29:30 28,672 ——w C:\WINDOWS\system32\drivers\atinsnxx.sys 2004-08-04 05:29:30 13,824 ——w C:\WINDOWS\system32\drivers\atinttxx.sys 2004-08-04 05:29:30 104,960 ——w C:\WINDOWS\system32\drivers\atinrvxx.sys 2004-08-04 05:29:29 56,623 ——w C:\WINDOWS\system32\drivers\ati1btxx.sys 2004-08-04 05:29:29 52,224 ——w C:\WINDOWS\system32\drivers\atinraxx.sys 2004-08-04 05:29:29 14,336 ——w C:\WINDOWS\system32\drivers\atinpdxx.sys 2004-08-04 05:29:29 12,047 ——w C:\WINDOWS\system32\drivers\ati1pdxx.sys 2004-08-04 05:29:29 11,615 ——w C:\WINDOWS\system32\drivers\ati1mdxx.sys 2004-08-04 05:29:28 13,824 ——w C:\WINDOWS\system32\drivers\atinmdxx.sys 2004-08-04 05:29:27 57,856 ——w C:\WINDOWS\system32\drivers\atinbtxx.sys 2004-08-04 05:29:26 701,440 ——w C:\WINDOWS\system32\drivers\ati2mtag.sys 2004-08-04 05:29:26 327,040 ——w C:\WINDOWS\system32\drivers\ati2mtaa.sys 2004-08-02 20:20:40 4,569 ——w C:\WINDOWS\system32\secupd.dat 2004-07-30 13:10:02 589,824 —-a-w C:\WINDOWS\system32\DVDRProX.dll 2004-07-24 19:15:22 ——– d—–w C:\Program Files\Common Files\Nullsoft 2004-07-17 18:39:14 174,200 —-a-w C:\WINDOWS\system32\xenroll.dll 2004-07-17 17:18:40 206,848 —-a-w C:\WINDOWS\system32\in10b6s.dll 2004-07-15 06:24:50 155,648 —-a-w C:\WINDOWS\system32\mscoree.dll 2004-07-15 05:34:06 16,896 —-a-w C:\WINDOWS\system32\mscorier.dll 2004-07-07 23:11:44 ——– d—–w C:\Program Files\Ahead 2004-07-07 23:11:28 ——– d—–w C:\Program Files\Common Files\Ahead 2004-07-06 23:51:09 ——– d—–w C:\Program Files\coolpro2 2004-07-06 23:48:19 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Syntrillium 2004-07-04 23:04:07 ——– d—–w C:\Program Files\Norton AntiVirus 2004-07-03 02:49:02 94,449 —-a-w C:\WINDOWS\systb.exe 2004-06-29 15:28:42 ——– d—–w C:\Program Files\Activision 2004-06-28 16:11:02 29 —-a-w C:\WINDOWS\72383783.dat 2004-06-18 19:40:50 33,280 —-a-w C:\WINDOWS\muninst.exe 2004-06-09 13:29:56 6,977 —-a-w C:\WINDOWS\system32\DDMI2.sys 2004-06-03 15:43:01 17,871 —-a-w C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.dat 2004-06-03 15:43:01 167,936 —-a-w C:\WINDOWS\system32\SpoonUninstall.exe 2004-06-03 15:42:57 ——– d—–w C:\Program Files\Illustrate 2004-06-03 07:50:08 94,208 —-a-w C:\WINDOWS\system32\ipcoin4.dll 2004-06-03 07:50:08 20,352 —-a-w C:\WINDOWS\system32\drivers\point32.sys 2004-06-01 04:27:06 33,280 —-a-w C:\WINDOWS\is-7M66T.exe 2004-05-24 06:21:39 212,992 —-a-w C:\WINDOWS\system32\wodShellMenu.dll 2004-05-20 18:24:04 196,608 —-a-w C:\WINDOWS\system32\NCTWMAFile2.dll 2004-05-20 17:03:12 1,036,288 —-a-w C:\WINDOWS\system32\NCTAudioInformation2.dll 2004-05-20 15:50:14 1,537,536 —-a-w C:\WINDOWS\system32\erdmpg-hi.dll 2004-05-11 16:37:54 3,584 —-a-w C:\WINDOWS\thin.exe 2004-05-10 12:10:57 ——– d—–w C:\Program Files\Common Files\SWF Studio 2004-04-18 20:58:38 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Kontiki 2004-04-10 17:24:44 26,112 —-a-w C:\WINDOWS\system32\xpsp1hfm.exe 2004-04-10 16:29:17 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\SmartFTP 2004-04-10 16:20:10 ——– d—–w C:\Program Files\SmartFTP 2004-04-10 16:15:12 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Help 2004-03-29 20:23:44 90,112 —-a-w C:\WINDOWS\unvise32.exe 2004-03-27 17:51:01 448 —-a-w C:\Program Files\PARADOX.Reg 2004-03-23 03:51:35 ——– d—–w C:\Program Files\Michael K. Weise 2004-03-20 14:37:40 ——– d—–w C:\Program Files\Dominion Wars 2004-03-14 17:08:10 ——– d—–w C:\Program Files\directx 2004-03-13 03:25:49 ——– d—–w C:\Program Files\FLAC 2004-03-08 17:55:50 13,567 ——w C:\WINDOWS\system32\drivers\CDRBSDRV.SYS 2004-03-07 18:59:59 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Ahead 2004-03-06 18:51:27 ——– d—–w C:\Program Files\burst 2004-03-01 18:52:15 358,976 —-a-w C:\WINDOWS\system32\msjetoledb40.dll 2004-03-01 17:33:20 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Sonic 2004-03-01 17:31:37 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Leadertech 2004-03-01 01:12:09 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\InterVideo 2004-02-29 22:11:31 ——– d—–w C:\Program Files\Total War 2004-02-29 18:34:08 ——– d—–w C:\Program Files\Efficient Networks 2004-02-29 17:51:52 ——– d—–w C:\Program Files\Netscape 2004-02-29 17:21:29 ——– d—–w C:\Program Files\Alcatel 2004-02-29 04:02:42 2,397 —-a-w C:\WINDOWS\system32\drivers\symlcbrd.sys 2004-02-29 04:02:35 ——– d—–w C:\Program Files\Symantec 2004-02-29 03:26:47 ——– d—–w C:\Program Files\ArcSoft 2004-02-22 08:11:09 719,872 —-a-w C:\WINDOWS\system32\devil.dll 2004-02-17 11:49:20 65,536 —-a-w C:\WINDOWS\system32\Audio3D.dll 2004-02-17 11:49:20 65,536 —-a-w C:\WINDOWS\system32\a3d.dll 2004-02-17 11:49:14 391,424 —-a-w C:\WINDOWS\system32\drivers\ALCXSENS.SYS 2003-10-14 13:51:57 0 -c–a-w C:\WINDOWS\system32\iAlmcoin.dll 2003-10-14 13:35:01 ——– d—–w C:\Program Files\interMute 2003-10-14 13:35:01 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\interMute 2003-10-14 13:31:38 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\Symantec 2003-10-11 13:03:58 ——– d—–w C:\DOCUME~1\Owner\APPLIC~1\SampleView 2003-10-11 12:58:46 ——– d—–w C:\Program Files\Easy Internet signup 2003-10-11 12:57:55 ——– d—–w C:\Program Files\Online Services 2003-10-11 12:51:03 ——– d—–w C:\Program Files\PC-Doctor for Windows 2003-10-11 12:47:44 ——– d—–w C:\Program Files\Compaq Instant Support 2003-10-11 12:45:41 167,936 —-a-w C:\WINDOWS\system32\PCDrJNI_1_1.dll 2003-10-11 12:42:56 ——– d—–w C:\Program Files\Compaq Connections 2003-10-11 12:42:55 90,112 —-a-r C:\WINDOWS\bwUnin-6.2.3.66L.exe 2003-10-11 12:40:57 29,222 —-a-w C:\WINDOWS\system32\CHODDI.SYS 2003-10-11 12:27:51 ——– d—–w C:\Program Files\Microsoft.NET 2003-10-11 12:21:21 ——– d—–w C:\Program Files\Microsoft Plus! Digital Media Edition 2003-10-11 12:19:59 ——– d—–w C:\Program Files\Microsoft Money 2003-10-11 12:16:44 ——– d—–w C:\Program Files\Quicken 2003-10-11 12:16:38 ——– d—–w C:\Program Files\Common Files\Palo Alto Software 2003-10-11 12:16:35 ——– d—–w C:\Program Files\Common Files\Intuit 2003-10-11 12:13:25 ——– d—–w C:\Program Files\IntelliMover Data Transfer Demo 2003-10-11 12:11:37 ——– d—–w C:\Program Files\InterVideo 2003-10-11 12:10:28 ——– d—–w C:\Program Files\Zone.com 2003-10-11 12:07:35 ——– d—–w C:\Program Files\Real 2003-10-11 12:06:50 ——– d—–w C:\Program Files\MSN Encarta Plus 2003-10-11 12:06:23 ——– d—–w C:\Program Files\Common Files\Sonic 2003-10-11 12:06:14 ——– d—–w C:\Program Files\RecordNow! 2003-10-11 12:06:14 ——– d—–w C:\Program Files\Common Files\SureThing Shared 2003-10-11 12:06:12 ——– d—–w C:\Program Files\Sonic 2003-10-11 11:35:16 18,403 —-a-w C:\WINDOWS\HPHins01.dat 2003-10-11 11:35:12 ——– d—–w C:\Program Files\HP 2003-10-11 11:29:58 ——– d—–w C:\Program Files\Common Files\Hewlett-Packard 2003-10-11 11:27:55 ——– d—–w C:\Program Files\Common Files\HP 2003-10-11 11:25:13 28,885 —-a-w C:\WINDOWS\hpoins03.dat 2003-10-11 10:16:10 ——– d—–w C:\Program Files\microsoft frontpage 2003-10-11 10:14:26 ——– d—–w C:\Program Files\Common Files\MSSoap 2003-10-11 10:14:08 21,640 —-a-w C:\WINDOWS\system32\emptyregdb.dat 2003-10-11 10:13:18 ——– d—–w C:\Program Files\MSN Gaming Zone 2003-10-11 07:54:51 1,100 —-a-w C:\WINDOWS\system32\d3d8caps.dat 2003-10-11 03:10:25 ——– d—–w C:\Program Files\Common Files\ODBC 2003-10-11 03:10:23 ——– d—–w C:\Program Files\Common Files\SpeechEngines 2003-09-03 16:01:22 10,368 —-a-w C:\WINDOWS\system32\drivers\pfc.sys 2003-09-03 06:51:00 98,304 —-a-w C:\WINDOWS\system32\nvugart.exe 2003-09-03 06:51:00 21,120 —-a-w C:\WINDOWS\system32\drivers\nv_agp.SYS 2003-08-19 15:01:00 49,152 —-a-w C:\WINDOWS\system32\umloader.dll 2003-08-19 09:56:00 86,016 —-a-w C:\WINDOWS\system32\nvwrszht.dll 2003-08-19 09:56:00 86,016 —-a-w C:\WINDOWS\system32\nvwrszhc.dll 2003-08-19 09:56:00 852,038 —-a-w C:\WINDOWS\system32\nview.dll 2003-08-19 09:56:00 77,824 —-a-w C:\WINDOWS\system32\nvsvc32.exe 2003-08-19 09:56:00 512,000 —-a-w C:\WINDOWS\system32\nviewimg.dll 2003-08-19 09:56:00 49,152 —-a-w C:\WINDOWS\system32\nvmctray.dll 2003-08-19 09:56:00 471,112 —-a-w C:\WINDOWS\system32\nvshell.dll 2003-08-19 09:56:00 45,127 —-a-w C:\WINDOWS\system32\nvwddi.dll 2003-08-19 09:56:00 4,841,472 —-a-w C:\WINDOWS\system32\nvcpl.dll 2003-08-19 09:56:00 323,584 —-a-w C:\WINDOWS\system32\nwiz.exe 2003-08-19 09:56:00 3,920,971 —-a-w C:\WINDOWS\system32\nv4_disp.dll 2003-08-19 09:56:00 3,850,240 —-a-w C:\WINDOWS\system32\nvoglnt.dll 2003-08-19 09:56:00 3,485,696 —-a-w C:\WINDOWS\system32\nvrsja.dll 2003-08-19 09:56:00 3,481,600 —-a-w C:\WINDOWS\system32\nvrsko.dll 2003-08-19 09:56:00 278,528 —-a-w C:\WINDOWS\system32\nvrsit.dll 2003-08-19 09:56:00 278,528 —-a-w C:\WINDOWS\system32\nvrsfr.dll 2003-08-19 09:56:00 274,432 —-a-w C:\WINDOWS\system32\nvrsptb.dll 2003-08-19 09:56:00 274,432 —-a-w C:\WINDOWS\system32\nvrsnl.dll 2003-08-19 09:56:00 274,432 —-a-w C:\WINDOWS\system32\nvrses.dll 2003-08-19 09:56:00 274,432 —-a-w C:\WINDOWS\system32\nvrsde.dll 2003-08-19 09:56:00 270,336 —-a-w C:\WINDOWS\system32\nvrstr.dll 2003-08-19 09:56:00 270,336 —-a-w C:\WINDOWS\system32\nvrspt.dll 2003-08-19 09:56:00 266,240 —-a-w C:\WINDOWS\system32\nvrssv.dll 2003-08-19 09:56:00 266,240 —-a-w C:\WINDOWS\system32\nvrsno.dll 2003-08-19 09:56:00 266,240 —-a-w C:\WINDOWS\system32\nvrseng.dll 2003-08-19 09:56:00 266,240 —-a-w C:\WINDOWS\system32\nvrsda.dll 2003-08-19 09:56:00 258,048 —-a-w C:\WINDOWS\system32\nvrsfi.dll 2003-08-19 09:56:00 221,184 —-a-w C:\WINDOWS\system32\nvrszht.dll 2003-08-19 09:56:00 221,184 —-a-w C:\WINDOWS\system32\nvrszhc.dll 2003-08-19 09:56:00 2,863,104 —-a-w C:\WINDOWS\system32\nvrsar.dll 2003-08-19 09:56:00 176,128 —-a-w C:\WINDOWS\system32\nvwrspt.dll 2003-08-19 09:56:00 176,128 —-a-w C:\WINDOWS\system32\nvwrses.dll 2003-08-19 09:56:00 176,128 —-a-w C:\WINDOWS\system32\nvwrsde.dll 2003-08-19 09:56:00 172,032 —-a-w C:\WINDOWS\system32\nvwrsptb.dll 2003-08-19 09:56:00 172,032 —-a-w C:\WINDOWS\system32\nvwrsit.dll 2003-08-19 09:56:00 172,032 —-a-w C:\WINDOWS\system32\nvwrsfr.dll 2003-08-19 09:56:00 167,936 —-a-w C:\WINDOWS\system32\nvwrsnl.dll 2003-08-19 09:56:00 163,840 —-a-w C:\WINDOWS\system32\nvwrstr.dll 2003-08-19 09:56:00 163,840 —-a-w C:\WINDOWS\system32\nvwrsfi.dll 2003-08-19 09:56:00 159,744 —-a-w C:\WINDOWS\system32\nvwrssv.dll 2003-08-19 09:56:00 159,744 —-a-w C:\WINDOWS\system32\nvwrsno.dll 2003-08-19 09:56:00 159,744 —-a-w C:\WINDOWS\system32\nvwrsda.dll 2003-08-19 09:56:00 147,456 —-a-w C:\WINDOWS\system32\nvwrseng.dll 2003-08-19 09:56:00 143,360 —-a-w C:\WINDOWS\system32\nvwrsar.dll 2003-08-19 09:56:00 131,072 —-a-w C:\WINDOWS\system32\nvinstnt.dll 2003-08-19 09:56:00 106,496 —-a-w C:\WINDOWS\system32\nvwrsja.dll 2003-08-19 09:56:00 102,400 —-a-w C:\WINDOWS\system32\nvwrsko.dll 2003-08-19 09:56:00 1,343,803 —-a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2003-08-19 09:56:00 1,323,008 —-a-w C:\WINDOWS\system32\dmcpl.exe 2003-08-16 00:22:12 83,208 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL 2003-08-16 00:22:12 82,136 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2003-08-16 00:08:00 50,440 —-a-w C:\WINDOWS\system32\SymTdiRg.exe 2003-08-16 00:07:58 15,176 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys 2003-08-16 00:07:58 11,688 —-a-w C:\WINDOWS\system32\drivers\symids.sys 2003-08-16 00:07:56 91,400 —-a-w C:\WINDOWS\system32\SymRedir.dll 2003-08-16 00:07:56 70,536 —-a-w C:\WINDOWS\system32\drivers\symfw.sys 2003-08-16 00:07:56 33,960 —-a-w C:\WINDOWS\system32\drivers\symndis.sys 2003-08-16 00:07:56 10,664 —-a-w C:\WINDOWS\system32\drivers\symdns.sys 2003-08-16 00:05:30 176,963 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys 2003-08-15 05:21:56 131,072 —-a-w C:\WINDOWS\system32\SpSubLSP.dll 2003-08-12 11:31:38 34,468 —-a-w C:\WINDOWS\hpomdl03.dat 2003-08-12 04:10:14 1,720,320 —-a-w C:\WINDOWS\system32\vticd.dll 2003-08-12 04:09:18 265,344 —-a-w C:\WINDOWS\system32\drivers\vtmini.sys 2003-08-12 04:08:50 1,851,904 —-a-w C:\WINDOWS\system32\vtdisp.dll 2003-08-07 18:01:50 237,568 —-a-w C:\WINDOWS\system32\lame_enc.dll 2003-08-05 04:28:34 138,320 —-a-w C:\WINDOWS\system32\RTCRES.dll 2003-08-04 00:56:16 1,146,184 —-a-w C:\WINDOWS\system32\FM20.DLL 2003-08-01 09:09:58 54,784 —-a-w C:\WINDOWS\system32\msvci70.dll 2003-08-01 09:09:58 212,480 —-a-r C:\WINDOWS\system32\PCDLIB32.DLL 2003-08-01 09:09:56 81,408 —-a-r C:\WINDOWS\system32\lffax11n.dll 2003-08-01 09:09:56 716,288 —-a-r C:\WINDOWS\system32\Ltwvc11n.dll 2003-08-01 09:09:56 41,472 —-a-r C:\WINDOWS\system32\lfgif11n.dll 2003-08-01 09:09:56 392,192 —-a-r C:\WINDOWS\system32\ltkrn11n.dll 2003-08-01 09:09:56 33,280 —-a-r C:\WINDOWS\system32\lfpcx11n.dll 2003-08-01 09:09:56 285,184 —-a-r C:\WINDOWS\system32\LFCMP11n.DLL 2003-08-01 09:09:56 27,648 —-a-r C:\WINDOWS\system32\lftga11n.dll 2003-08-01 09:09:56 262,656 —-a-r C:\WINDOWS\system32\LTDIS11n.dll 2003-08-01 09:09:56 172,032 —-a-r C:\WINDOWS\system32\Lfpng11n.dll 2003-08-01 09:09:56 152,064 —-a-r C:\WINDOWS\system32\lftif11n.dll 2003-08-01 09:09:56 118,784 —-a-r C:\WINDOWS\system32\ltfil11n.DLL 2003-08-01 09:09:54 84,992 —-a-w C:\WINDOWS\system32\atl70.dll 2003-08-01 09:09:54 36,864 —-a-r C:\WINDOWS\system32\lfbmp11n.dll 2003-08-01 09:06:38 86,016 —-a-w C:\WINDOWS\system32\pxwma.dll 2003-07-30 11:49:56 1,699,913 —-a-w C:\WINDOWS\system32\InetClnt.dll 2003-07-30 09:15:00 13,006 —-a-w C:\WINDOWS\system32\drivers\nvxbar.sys 2003-07-30 09:15:00 126,348 —-a-w C:\WINDOWS\system32\drivers\nvcap.sys 2003-07-26 01:15:20 212,992 —-a-w C:\WINDOWS\system32\HPODStormEncoder.dll 2003-07-22 23:12:36 94,208 —-a-r C:\WINDOWS\system32\hpzjsn01.dll 2003-07-22 23:12:34 49,152 —-a-r C:\WINDOWS\system32\hpzjrd01.dll 2003-07-19 01:53:04 77,824 —-a-w C:\WINDOWS\system32\ProgressTrace.dll 2003-07-19 01:52:16 20,348 —-a-w C:\WINDOWS\system32\drivers\pcdrsrvc.sys 2003-07-19 01:52:14 94,208 —-a-w C:\WINDOWS\system32\PcdrKernelModeServices.dll 2003-07-17 14:23:18 44,032 —-a-w C:\WINDOWS\system32\msxml3r.dll 2003-07-15 12:57:04 32,584 —-a-w C:\WINDOWS\system32\FM20ENU.DLL 2003-07-15 00:52:44 40,960 —-a-w C:\WINDOWS\ltmsg.exe 2003-07-14 22:02:02 81,982 —-a-w C:\WINDOWS\system32\NCSUtil.dll 2003-07-14 22:02:02 53,310 —-a-w C:\WINDOWS\system32\NCScnet.dll 2003-07-14 22:02:02 41,022 —-a-w C:\WINDOWS\system32\NCSEcwC.dll 2003-07-14 22:02:02 188,477 —-a-w C:\WINDOWS\system32\NCSEcw.dll 2003-07-14 21:58:36 6,144 —-a-w C:\WINDOWS\system32\AWDCXC32.DLL 2003-07-14 21:58:36 26,624 —-a-w C:\WINDOWS\system32\AWRESX32.DLL 2003-07-14 21:58:36 24,576 —-a-w C:\WINDOWS\system32\AWCODC32.DLL 2003-07-14 21:58:36 11,776 —-a-w C:\WINDOWS\system32\AWDENC32.DLL 2003-07-14 21:58:36 10,240 —-a-w C:\WINDOWS\system32\AWVIEW32.DLL 2003-07-07 18:41:08 33,792 —-a-w C:\WINDOWS\oeuninst.exe 2003-07-02 18:42:00 27,904 —-a-w C:\WINDOWS\system32\drivers\VIAAGP1.SYS 2003-07-02 06:33:00 652,497 —-a-w C:\WINDOWS\system32\drivers\ltmdmnt.sys 2003-06-19 10:10:52 974,848 —-a-r C:\WINDOWS\system32\mfc70.dll 2003-06-19 10:10:52 65,536 —-a-r C:\WINDOWS\system32\PfcNTReg.dll 2003-06-19 08:59:00 140,800 —-a-w C:\WINDOWS\system32\drivers\Fasttx2k.sys 2003-06-19 07:31:48 17,920 —-a-w C:\WINDOWS\system32\mdimon.dll 2003-06-19 02:00:00 415,504 —-a-w C:\WINDOWS\system32\msrepl35.dll 2003-06-19 02:00:00 24,848 —-a-w C:\WINDOWS\system32\msjter35.dll 2003-06-19 02:00:00 123,664 —-a-w C:\WINDOWS\system32\msjint35.dll 2003-06-19 02:00:00 1,050,384 —-a-w C:\WINDOWS\system32\msjet35.dll 2003-06-04 00:28:18 783,872 —-a-w C:\WINDOWS\system32\RDBios32.dll 2003-05-30 02:16:24 28,672 —-a-w C:\WINDOWS\system32\omano.dll 2003-05-23 09:55:38 483,328 —-a-w C:\WINDOWS\system32\hphmon05.exe 2003-05-23 09:44:48 6,848 —-a-w C:\WINDOWS\system32\hphmon05.dat 2003-05-23 09:44:08 4,308 —-a-w C:\WINDOWS\hphmdl01.dat 2003-05-21 00:09:42 141,312 —-a-w C:\WINDOWS\system32\OemInfo.dll 2003-05-17 00:54:44 61,699 —-a-w C:\WINDOWS\system32\hpzinw12.exe 2003-05-17 00:54:44 57,344 —-a-w C:\WINDOWS\system32\hpzisn12.dll 2003-05-17 00:54:42 94,208 —-a-w C:\WINDOWS\system32\hpzipt12.dll 2003-05-17 00:54:40 196,608 —-a-w C:\WINDOWS\system32\hpzipr12.dll 2003-05-17 00:54:38 266,296 —-a-w C:\WINDOWS\system32\hpzidr12.dll 2003-05-17 00:54:34 65,795 —-a-w C:\WINDOWS\system32\hpzipm12.exe 2003-05-08 07:25:44 1,067,008 —-a-w C:\WINDOWS\system32\sisgrv.dll 2003-05-06 22:34:56 394,752 —-a-w C:\WINDOWS\system32\drivers\sisgrp.sys 2003-04-29 01:34:12 1,854,918 —-a-w C:\WINDOWS\system32\sisgl.dll 2003-04-28 19:59:26 49,152 —-a-w C:\WINDOWS\system32\ciaPLRegSvr.dll 2003-04-22 04:18:00 77,824 —-a-w C:\WINDOWS\system32\nvuenet.exe 2003-04-22 04:18:00 54,784 —-a-w C:\WINDOWS\system32\drivers\NVENET.sys 2003-04-19 21:06:13 323,584 —-a-w C:\WINDOWS\system32\NCTDiscRipper.dll 2003-04-16 00:41:04 10,807 —-a-w C:\WINDOWS\system32\drivers\a314.sys 2003-04-16 00:41:00 37,431 —-a-w C:\WINDOWS\system32\drivers\a313.sys 2003-04-16 00:40:56 33,792 —-a-w C:\WINDOWS\system32\ialmrnt5.dll 2003-04-16 00:40:54 113,504 —-a-w C:\WINDOWS\system32\drivers\ialmsbw.sys 2003-04-16 00:40:46 78,752 —-a-w C:\WINDOWS\system32\drivers\ialmkchw.sys 2003-04-16 00:40:40 73,728 —-a-w C:\WINDOWS\system32\ialmrem.dll 2003-04-16 00:40:36 20,533 —-a-w C:\WINDOWS\system32\drivers\vch.sys 2003-04-16 00:40:32 32,823 —-a-w C:\WINDOWS\system32\drivers\a311.sys 2003-04-16 00:40:28 33,335 —-a-w C:\WINDOWS\system32\drivers\a310.sys 2003-04-16 00:40:24 25,655 —-a-w C:\WINDOWS\system32\drivers\a309.sys 2003-04-16 00:40:20 10,807 —-a-w C:\WINDOWS\system32\drivers\a308.sys 2003-04-16 00:40:16 21,559 —-a-w C:\WINDOWS\system32\drivers\a307.sys 2003-04-16 00:40:12 16,439 —-a-w C:\WINDOWS\system32\drivers\a306.sys 2003-04-16 00:40:08 11,831 —-a-w C:\WINDOWS\system32\drivers\a305.sys 2003-04-16 00:40:04 46,647 —-a-w C:\WINDOWS\system32\drivers\a304.sys 2003-04-16 00:39:58 29,239 —-a-w C:\WINDOWS\system32\drivers\a303.sys 2003-04-16 00:39:54 11,319 —-a-w C:\WINDOWS\system32\drivers\a302.sys 2003-04-16 00:39:50 33,335 —-a-w C:\WINDOWS\system32\drivers\wa301b.sys 2003-04-16 00:39:50 33,335 —-a-w C:\WINDOWS\system32\drivers\wa301a.sys 2003-04-16 00:39:48 65,536 —-a-w C:\WINDOWS\system32\iAlmCoIn_v13_1.dll 2003-04-16 00:39:46 90,907 —-a-w C:\WINDOWS\system32\drivers\ialmnt5.sys 2003-04-16 00:39:44 115,772 —-a-w C:\WINDOWS\system32\ialmdnt5.dll 2003-04-16 00:39:36 187,963 —-a-w C:\WINDOWS\system32\ialmdev5.dll 2003-04-16 00:39:10 459,330 —-a-w C:\WINDOWS\system32\ialmdd5.dll 2003-04-16 00:20:48 188,416 —-a-w C:\WINDOWS\system32\ialmgdev.dll 2003-04-16 00:20:12 1,859,584 —-a-w C:\WINDOWS\system32\ialmgicd.dll 2003-04-11 15:51:30 10,624 —-a-w C:\WINDOWS\system32\drivers\srvkp.sys 2003-04-11 15:01:30 5,632 —-a-w C:\WINDOWS\system32\instFunc.dll 2003-04-11 15:01:24 172,032 —-a-w C:\WINDOWS\system32\SiSInst.dll 2003-04-11 15:01:10 221,184 —-a-w C:\WINDOWS\system32\SiSParse.dll 2003-04-11 15:00:46 98,304 —-a-w C:\WINDOWS\system32\SiSApCom.dll 2003-04-11 06:04:00 77,824 —-a-w C:\WINDOWS\system32\WindowsAccessBridge.dll 2003-04-11 06:04:00 28,672 —-a-w C:\WINDOWS\system32\JAWTAccessBridge.dll 2003-04-11 06:04:00 139,264 —-a-w C:\WINDOWS\system32\JavaAccessBridge.dll 2003-04-07 14:20:14 32,768 —-a-w C:\WINDOWS\system32\igfxexps.dll 2003-04-07 14:20:10 90,112 —-a-w C:\WINDOWS\system32\igfxext.exe 2003-04-07 14:19:52 155,648 —-a-w C:\WINDOWS\system32\igfxtray.exe 2003-04-07 14:18:56 204,800 —-a-w C:\WINDOWS\system32\igfxpph.dll 2003-04-07 14:17:44 221,184 —-a-w C:\WINDOWS\system32\igfxeud.dll 2003-04-07 14:15:52 45,056 —-a-w C:\WINDOWS\system32\igfxdgps.dll 2003-04-07 14:15:50 151,552 —-a-w C:\WINDOWS\system32\igfxdiag.exe 2003-04-07 14:13:58 487,424 —-a-w C:\WINDOWS\system32\igfxcfg.exe 2003-04-07 14:07:38 114,688 —-a-w C:\WINDOWS\system32\hkcmd.exe 2003-04-07 14:07:12 118,784 —-a-w C:\WINDOWS\system32\igfxhk.dll 2003-04-07 14:06:48 315,392 —-a-w C:\WINDOWS\system32\igfxsrvc.dll 2003-04-07 14:05:42 503,808 —-a-w C:\WINDOWS\system32\igfxress.dll 2003-04-07 14:05:26 155,648 —-a-w C:\WINDOWS\system32\igfxres.dll 2003-04-07 14:05:16 118,784 —-a-w C:\WINDOWS\system32\hccutils.dll 2003-04-07 14:04:54 147,456 —-a-w C:\WINDOWS\system32\igfxdev.dll 2003-04-07 14:04:14 86,016 —-a-w C:\WINDOWS\system32\igfxdo.dll 2003-04-03 17:09:48 81,920 —-a-w C:\WINDOWS\system32\mplaw7.dll 2003-04-03 17:09:48 81,920 —-a-w C:\WINDOWS\system32\mplaa6.dll 2003-04-03 17:09:48 69,632 —-a-w C:\WINDOWS\system32\mplapx.dll 2003-04-03 17:09:48 69,632 —-a-w C:\WINDOWS\system32\mplam6.dll 2003-04-03 17:09:48 49,152 —-a-w C:\WINDOWS\system32\cpuinf32.dll 2003-04-03 17:09:48 1,675,264 —-a-w C:\WINDOWS\system32\mplva6.dll 2003-04-03 17:09:48 1,630,208 —-a-w C:\WINDOWS\system32\mplvw7.dll 2003-04-03 17:09:48 1,581,056 —-a-w C:\WINDOWS\system32\mplvm6.dll 2003-04-03 17:09:48 1,150,976 —-a-w C:\WINDOWS\system32\mplvpx.dll 2003-03-27 07:47:24 139,320 —-a-w C:\WINDOWS\system32\hpzlnt08.dll 2003-03-27 07:38:10 258,048 —-a-w C:\WINDOWS\system32\hpzcon08.dll 2003-03-27 07:36:58 192,512 —-a-w C:\WINDOWS\system32\hpzcoi08.dll 2003-03-19 11:20:00 1,060,864 —-a-w C:\WINDOWS\system32\mfc71.dll 2003-03-19 11:12:12 1,047,552 —-a-w C:\WINDOWS\system32\mfc71u.dll 2003-03-19 10:44:38 57,344 —-a-w C:\WINDOWS\system32\MFC71ENU.DLL 2003-03-19 10:44:38 49,152 —-a-w C:\WINDOWS\system32\MFC71KOR.DLL 2003-03-19 10:44:36 61,440 —-a-w C:\WINDOWS\system32\MFC71ITA.DLL 2003-03-19 10:44:36 61,440 —-a-w C:\WINDOWS\system32\MFC71ESP.DLL 2003-03-19 10:44:36 45,056 —-a-w C:\WINDOWS\system32\MFC71CHT.DLL 2003-03-19 10:44:36 40,960 —-a-w C:\WINDOWS\system32\MFC71CHS.DLL 2003-03-19 10:44:34 65,536 —-a-w C:\WINDOWS\system32\MFC71DEU.DLL 2003-03-19 10:44:34 61,440 —-a-w C:\WINDOWS\system32\MFC71FRA.DLL 2003-03-19 10:44:34 49,152 —-a-w C:\WINDOWS\system32\MFC71JPN.DLL 2003-03-19 09:05:50 89,088 —-a-w C:\WINDOWS\system32\atl71.dll 2003-03-16 20:16:46 6,656 —-a-w C:\WINDOWS\system32\DLPT2.sys 2003-03-03 15:24:32 33,792 —-a-w C:\WINDOWS\Q330994.exe 2003-03-03 15:24:32 33,792 —-a-w C:\WINDOWS\ieuninst.exe 2003-02-21 09:16:34 32,768 —-a-w C:\WINDOWS\system32\netfxperf.dll 2003-02-21 09:09:14 106,496 —-a-w C:\WINDOWS\system32\mscories.dll 2003-02-20 23:18:36 36,608 —-a-w C:\WINDOWS\system32\drivers\SISAGPX.SYS 2003-02-20 22:39:42 24,576 —-a-w C:\WINDOWS\system32\dbmsvinn.dll 2003-02-20 22:39:40 28,672 —-a-w C:\WINDOWS\system32\dbmsgnet.dll 2003-02-20 22:39:40 24,576 —-a-w C:\WINDOWS\system32\dbmsadsn.dll 2003-02-19 01:18:42 774,144 —-a-w C:\WINDOWS\system32\nbicdnt.dll 2003-02-06 17:33:04 4,656 —-a-w C:\WINDOWS\system32\ds16gt.dll 2003-02-06 17:33:04 26,224 —-a-w C:\WINDOWS\system32\odbc16gt.dll 2003-02-01 02:59:46 118,784 —-a-r C:\WINDOWS\system32\HPODXPAT.DLL 2003-01-07 20:26:38 69,690 —-a-w C:\WINDOWS\system32\VTuninst.exe 2003-01-07 20:26:38 69,690 —-a-w C:\WINDOWS\system32\S3uninst.exe 2002-12-17 22:23:52 29,244 —-a-w C:\WINDOWS\system32\DBmsLPCn.dll 2002-12-17 21:23:52 33,340 —-a-w C:\WINDOWS\system32\dbmsqlgc.dll 2002-12-12 06:14:32 46,592 —-a-w C:\WINDOWS\system32\dxdllreg.exe 2002-10-16 03:41:06 102,220 —-a-w C:\WINDOWS\system32\drivers\sonypvs1.sys 2002-10-05 00:04:10 46,976 —-a-w C:\WINDOWS\system32\drivers\R8139n51.sys 2002-09-21 05:42:28 122,880 —-a-w C:\WINDOWS\system32\ShellvRTF.dll 2002-08-29 19:00:00 86,073 —-a-w C:\WINDOWS\system32\usrfaxa.dll 2002-08-29 19:00:00 847,872 —-a-w C:\WINDOWS\system32\dbgeng.dll 2002-08-29 19:00:00 8,192 —-a-w C:\WINDOWS\system32\winhlp32.exe 2002-08-29 19:00:00 8,192 —-a-w C:\WINDOWS\system32\streamci.dll 2002-08-29 19:00:00 8,192 —-a-w C:\WINDOWS\system32\kbdhept.dll 2002-08-29 19:00:00 77,891 —-a-w C:\WINDOWS\system32\usrmlnka.exe 2002-08-29 19:00:00 77,890 —-a-w C:\WINDOWS\system32\usrdpa.dll 2002-08-29 19:00:00 77,883 —-a-w C:\WINDOWS\system32\usrrtosa.dll 2002-08-29 19:00:00 72,192 —-a-w C:\WINDOWS\system32\sprio800.dll 2002-08-29 19:00:00 70,656 —-a-w C:\WINDOWS\system32\sprio600.dll 2002-08-29 19:00:00 7,168 —-a-w C:\WINDOWS\system32\kbdnec.dll 2002-08-29 19:00:00 7,168 —-a-w C:\WINDOWS\system32\kbdcz.dll 2002-08-29 19:00:00 69,700 —-a-w C:\WINDOWS\system32\usrshuta.exe 2002-08-29 19:00:00 69,699 —-a-w C:\WINDOWS\system32\usrcoina.dll 2002-08-29 19:00:00 69,632 —-a-w C:\WINDOWS\system32\spnike.dll 2002-08-29 19:00:00 61,508 —-a-w C:\WINDOWS\system32\usrprbda.exe 2002-08-29 19:00:00 61,500 —-a-w C:\WINDOWS\system32\usrcntra.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdycl.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdsl1.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdsl.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdsg.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdpl.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdla.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdhu.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdhela3.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdcz2.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdcz1.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\kbdcr.dll 2002-08-29 19:00:00 6,656 —-a-w C:\WINDOWS\system32\KBDAL.DLL 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdusx.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdusr.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdusl.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdtuq.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdtuf.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdsw.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdsp.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdsf.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdpo.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdno.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdne.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdlv1.dll

coheedKid

Post #7May 27, 2007, 4:11 PM UTC

2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdlv.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdic.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdhela2.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdgr1.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdgr.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdgkl.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdfr.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdfi.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdfc.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdest.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdes.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdda.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdca.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdbr.dll 2002-08-29 19:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdbe.dll 2002-08-29 19:00:00 58,112 —-a-w C:\WINDOWS\system32\drivers\vdmindvd.sys 2002-08-29 19:00:00 55,296 —-a-w C:\WINDOWS\system32\dvdplay.exe 2002-08-29 19:00:00 53,305 —-a-w C:\WINDOWS\system32\usrlbva.dll 2002-08-29 19:00:00 51,712 —-a-w C:\WINDOWS\system32\drivers\tosdvd.sys 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdus.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbduk.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdro.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdpl1.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdmon.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdlt1.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdlt.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdkyr.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdit142.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdit.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdir.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdhu1.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdhe319.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdhe220.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdhe.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdgae.dll 2002-08-29 19:00:00 5,632 —-a-w C:\WINDOWS\system32\kbdazel.dll 2002-08-29 19:00:00 5,120 —-a-w C:\WINDOWS\system32\kbddv.dll 2002-08-29 19:00:00 49,211 —-a-w C:\WINDOWS\system32\usrvpa.dll 2002-08-29 19:00:00 49,211 —-a-w C:\WINDOWS\system32\usrsdpia.dll 2002-08-29 19:00:00 49,209 —-a-w C:\WINDOWS\system32\usrv80a.dll 2002-08-29 19:00:00 45,116 —-a-w C:\WINDOWS\system32\usrvoica.dll 2002-08-29 19:00:00 435,712 —-a-w C:\WINDOWS\system32\shellstyle.dll 2002-08-29 19:00:00 41,019 —-a-w C:\WINDOWS\system32\usrsvpia.dll 2002-08-29 19:00:00 36,864 —-a-w C:\WINDOWS\system32\ntsdexts.dll 2002-08-29 19:00:00 323,641 —-a-w C:\WINDOWS\system32\usrdtea.dll 2002-08-29 19:00:00 31,744 —-a-w C:\WINDOWS\system32\ntsd.exe 2002-08-29 19:00:00 3,200 —-a-w C:\WINDOWS\system32\wowfax.dll 2002-08-29 19:00:00 262,528 —-a-w C:\WINDOWS\system32\drivers\cinemst2.sys 2002-08-29 19:00:00 23,936 —-a-w C:\WINDOWS\system32\drivers\usbcamd2.sys 2002-08-29 19:00:00 23,808 —-a-w C:\WINDOWS\system32\drivers\usbcamd.sys 2002-08-29 19:00:00 21,376 —-a-w C:\WINDOWS\system32\drivers\tsbvcap.sys 2002-08-29 19:00:00 18,688 —-a-w C:\WINDOWS\system32\drivers\cdaudio.sys 2002-08-29 19:00:00 157,696 —-a-w C:\WINDOWS\system32\paqsp.dll 2002-08-29 19:00:00 15,872 —-a-w C:\WINDOWS\system32\expand.exe 2002-08-29 19:00:00 147,968 —-a-w C:\WINDOWS\system32\mdwmdmsp.dll 2002-08-29 19:00:00 13,824 —-a-w C:\WINDOWS\system32\wowfaxui.dll 2002-08-29 19:00:00 121,856 —-a-w C:\WINDOWS\system32\exts.dll 2002-08-29 19:00:00 12,160 —-a-w C:\WINDOWS\system32\drivers\fsvga.sys 2002-08-29 19:00:00 12,032 —-a-w C:\WINDOWS\system32\drivers\riodrv.sys 2002-08-29 19:00:00 12,032 —-a-w C:\WINDOWS\system32\drivers\rio8drv.sys 2002-08-29 19:00:00 12,032 —-a-w C:\WINDOWS\system32\drivers\nikedrv.sys 2002-08-29 19:00:00 11,776 —-a-w C:\WINDOWS\system32\drivers\cpqdap01.sys 2002-08-29 19:00:00 102,457 —-a-w C:\WINDOWS\system32\usrv42a.dll 2002-08-29 12:00:00 99,840 —-a-w C:\WINDOWS\system32\mprmsg.dll 2002-08-29 12:00:00 98,304 —-a-w C:\WINDOWS\system32\verifier.exe 2002-08-29 12:00:00 98,304 —-a-w C:\WINDOWS\system32\rtm.dll 2002-08-29 12:00:00 94,784 —-a-w C:\WINDOWS\twain.dll 2002-08-29 12:00:00 94,282 —-a-w C:\WINDOWS\system32\msencode.dll 2002-08-29 12:00:00 924,432 —-a-w C:\WINDOWS\system32\mfc40.dll 2002-08-29 12:00:00 90,112 —-a-w C:\WINDOWS\system32\rsvpsp.dll 2002-08-29 12:00:00 90,112 —-a-w C:\WINDOWS\system32\mycomput.dll 2002-08-29 12:00:00 9,936 —-a-w C:\WINDOWS\system32\lzexpand.dll 2002-08-29 12:00:00 9,728 —-a-w C:\WINDOWS\system32\sprestrt.exe 2002-08-29 12:00:00 9,728 —-a-w C:\WINDOWS\system32\sfc.exe 2002-08-29 12:00:00 9,728 —-a-w C:\WINDOWS\system32\rsvpperf.dll 2002-08-29 12:00:00 9,728 —-a-w C:\WINDOWS\system32\reset.exe 2002-08-29 12:00:00 9,728 —-a-w C:\WINDOWS\system32\label.exe 2002-08-29 12:00:00 9,600 —-a-w C:\WINDOWS\system32\drivers\ndistapi.sys 2002-08-29 12:00:00 9,344 —-a-w C:\WINDOWS\system32\vga.dll 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\wshatm.dll 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\winfax.dll 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\wifeman.dll 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\subst.exe 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\print.exe 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\lprmonui.dll 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\finger.exe 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\find.exe 2002-08-29 12:00:00 9,216 —-a-w C:\WINDOWS\system32\diskcomp.com 2002-08-29 12:00:00 9,029 —-a-w C:\WINDOWS\system32\ansi.sys 2002-08-29 12:00:00 9,008 —-a-w C:\WINDOWS\system32\ver.dll 2002-08-29 12:00:00 89,600 —-a-w C:\WINDOWS\system32\langwrbk.dll 2002-08-29 12:00:00 882 —-a-w C:\WINDOWS\system32\share.exe 2002-08-29 12:00:00 882 —-a-w C:\WINDOWS\system32\fastopen.exe 2002-08-29 12:00:00 86,528 —-a-w C:\WINDOWS\system32\iassam.dll 2002-08-29 12:00:00 85,020 —-a-w C:\WINDOWS\system32\dgsetup.dll 2002-08-29 12:00:00 83,968 —-a-w C:\WINDOWS\system32\ipxmontr.dll 2002-08-29 12:00:00 82,944 —-a-w C:\WINDOWS\system32\olecli.dll 2002-08-29 12:00:00 82,432 —-a-w C:\WINDOWS\system32\ufat.dll 2002-08-29 12:00:00 817 —-a-w C:\WINDOWS\system32\mscdexnt.exe 2002-08-29 12:00:00 81,408 —-a-w C:\WINDOWS\system32\fsusd.dll 2002-08-29 12:00:00 80,384 —-a-w C:\WINDOWS\system32\charmap.exe 2002-08-29 12:00:00 80,384 —-a-w C:\WINDOWS\system32\autodisc.dll 2002-08-29 12:00:00 8,832 —-a-w C:\WINDOWS\system32\drivers\rasacd.sys 2002-08-29 12:00:00 8,704 —-a-w C:\WINDOWS\system32\eventvwr.exe 2002-08-29 12:00:00 8,424 —-a-w C:\WINDOWS\system32\exe2bin.exe 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\qosname.dll 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\psnppagn.dll 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\mountvol.exe 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\mciole16.dll 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\mag_hook.dll 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\lpr.exe 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\control.exe 2002-08-29 12:00:00 8,192 —-a-w C:\WINDOWS\system32\cidaemon.exe 2002-08-29 12:00:00 78,848 —-a-w C:\WINDOWS\system32\tapiui.dll 2002-08-29 12:00:00 77,824 —-a-w C:\WINDOWS\system32\wmpstub.exe 2002-08-29 12:00:00 76,800 —-a-w C:\WINDOWS\system32\gcdef.dll 2002-08-29 12:00:00 741 —-a-w C:\WINDOWS\system32\noise.dat 2002-08-29 12:00:00 74,240 —-a-w C:\WINDOWS\system32\dhcpsapi.dll 2002-08-29 12:00:00 73,802 —-a-w C:\WINDOWS\system32\msrclr40.dll 2002-08-29 12:00:00 73,728 —-a-w C:\WINDOWS\system32\csseqchk.dll 2002-08-29 12:00:00 73,216 —-a-w C:\WINDOWS\system32\avwav.dll 2002-08-29 12:00:00 707 —-a-w C:\WINDOWS\_default.pif 2002-08-29 12:00:00 70,656 —-a-w C:\WINDOWS\system32\ifsutil.dll 2002-08-29 12:00:00 7,936 —-a-w C:\WINDOWS\system32\drivers\fs_rec.sys 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\vcdex.dll 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\ncxpnt.dll 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\mll_mtf.dll 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\mciole32.dll 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\kbdcan.dll 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\hostname.exe 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\drivers\mcd.sys 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\ckcnv.exe 2002-08-29 12:00:00 7,680 —-a-w C:\WINDOWS\system32\chcp.com 2002-08-29 12:00:00 7,168 —-a-w C:\WINDOWS\system32\wshnetbs.dll 2002-08-29 12:00:00 7,168 —-a-w C:\WINDOWS\system32\recover.exe 2002-08-29 12:00:00 7,168 —-a-w C:\WINDOWS\system32\msr2cenu.dll 2002-08-29 12:00:00 7,168 —-a-w C:\WINDOWS\system32\mscat32.dll 2002-08-29 12:00:00 7,168 —-a-w C:\WINDOWS\system32\forcedos.exe 2002-08-29 12:00:00 7,168 —-a-w C:\WINDOWS\system32\diskcopy.com 2002-08-29 12:00:00 7,052 —-a-w C:\WINDOWS\system32\nlsfunc.exe 2002-08-29 12:00:00 7,040 —-a-w C:\WINDOWS\system32\kdcom.dll 2002-08-29 12:00:00 69,886 —-a-w C:\WINDOWS\system32\edit.com 2002-08-29 12:00:00 69,632 —-a-w C:\WINDOWS\system32\msr2c.dll 2002-08-29 12:00:00 69,584 —-a-w C:\WINDOWS\system32\avicap.dll 2002-08-29 12:00:00 69,120 —-a-w C:\WINDOWS\system32\olethk32.dll 2002-08-29 12:00:00 69,120 —-a-w C:\WINDOWS\system32\mprddm.dll 2002-08-29 12:00:00 69,120 —-a-w C:\WINDOWS\system32\ipxpromn.dll 2002-08-29 12:00:00 673,088 —-a-w C:\WINDOWS\system32\mlang.dat 2002-08-29 12:00:00 66,560 —-a-w C:\WINDOWS\system32\ipxsap.dll 2002-08-29 12:00:00 66,560 —-a-w C:\WINDOWS\system32\console.dll 2002-08-29 12:00:00 65,536 —-a-w C:\WINDOWS\system32\jgsh400.dll 2002-08-29 12:00:00 65,024 —-a-w C:\WINDOWS\system32\msaudite.dll 2002-08-29 12:00:00 64,512 —-a-w C:\WINDOWS\system32\acctres.dll 2002-08-29 12:00:00 64,000 —-a-w C:\WINDOWS\system32\avicap32.dll 2002-08-29 12:00:00 63,232 —-a-w C:\WINDOWS\system32\drivers\nwlnknb.sys 2002-08-29 12:00:00 62,976 —-a-w C:\WINDOWS\system32\dsauth.dll 2002-08-29 12:00:00 62,464 —-a-w C:\WINDOWS\system32\iasnap.dll 2002-08-29 12:00:00 62,464 —-a-w C:\WINDOWS\system32\dpnmodem.dll 2002-08-29 12:00:00 61,952 —-a-w C:\WINDOWS\system32\dpnwsock.dll 2002-08-29 12:00:00 61,168 —-a-w C:\WINDOWS\system32\msacm.dll 2002-08-29 12:00:00 605,696 —-a-w C:\WINDOWS\system32\getuname.dll 2002-08-29 12:00:00 60,928 —-a-w C:\WINDOWS\system32\ocmanage.dll 2002-08-29 12:00:00 60,416 —-a-w C:\WINDOWS\system32\msratelc.dll 2002-08-29 12:00:00 6,784 —-a-w C:\WINDOWS\system32\drivers\parvdm.sys 2002-08-29 12:00:00 6,656 —-a-w C:\WINDOWS\system32\routetab.dll 2002-08-29 12:00:00 6,656 —-a-w C:\WINDOWS\system32\msswchx.exe 2002-08-29 12:00:00 6,144 —-a-w C:\WINDOWS\system32\svcpack.dll 2002-08-29 12:00:00 6,144 —-a-w C:\WINDOWS\system32\lpq.exe 2002-08-29 12:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdmac.dll 2002-08-29 12:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdfo.dll 2002-08-29 12:00:00 6,144 —-a-w C:\WINDOWS\system32\kbdbene.dll 2002-08-29 12:00:00 590,336 —-a-w C:\WINDOWS\system32\d3dramp.dll 2002-08-29 12:00:00 59,392 —-a-w C:\WINDOWS\system32\iassvcs.dll 2002-08-29 12:00:00 57,856 —-a-w C:\WINDOWS\system32\scripto.dll 2002-08-29 12:00:00 57,856 —-a-w C:\WINDOWS\system32\ntlanui.dll 2002-08-29 12:00:00 565,760 —-a-w C:\WINDOWS\system32\msvcp50.dll 2002-08-29 12:00:00 56,832 —-a-w C:\WINDOWS\system32\sol.exe 2002-08-29 12:00:00 56,320 —-a-w C:\WINDOWS\system32\fsutil.exe 2002-08-29 12:00:00 55,936 —-a-w C:\WINDOWS\system32\drivers\nwlnkspx.sys 2002-08-29 12:00:00 55,296 —-a-w C:\WINDOWS\system32\freecell.exe 2002-08-29 12:00:00 54,784 —-a-w C:\WINDOWS\system32\icmui.dll 2002-08-29 12:00:00 54,272 —-a-w C:\WINDOWS\system32\stclient.dll 2002-08-29 12:00:00 53,520 —-a-w C:\WINDOWS\system32\dpserial.dll 2002-08-29 12:00:00 52,224 —-a-w C:\WINDOWS\system32\tsappcmp.dll 2002-08-29 12:00:00 51,712 —-a-w C:\WINDOWS\system32\migpwd.exe 2002-08-29 12:00:00 51,456 —-a-w C:\WINDOWS\system32\vga256.dll 2002-08-29 12:00:00 51,200 —-a-w C:\WINDOWS\system32\wmerrenu.dll 2002-08-29 12:00:00 51,200 —-a-w C:\WINDOWS\system32\syncapp.exe 2002-08-29 12:00:00 51,200 —-a-w C:\WINDOWS\system32\dfrgres.dll 2002-08-29 12:00:00 50,620 —-a-w C:\WINDOWS\system32\command.com 2002-08-29 12:00:00 50,176 —-a-w C:\WINDOWS\system32\mdhcp.dll 2002-08-29 12:00:00 50,176 —-a-w C:\WINDOWS\system32\loghours.dll 2002-08-29 12:00:00 5,888 —-a-w C:\WINDOWS\system32\drivers\rootmdm.sys 2002-08-29 12:00:00 5,888 —-a-w C:\WINDOWS\system32\drivers\dmload.sys 2002-08-29 12:00:00 5,632 —-a-w C:\WINDOWS\system32\write.exe 2002-08-29 12:00:00 5,632 —-a-w C:\WINDOWS\system32\tapiperf.dll 2002-08-29 12:00:00 5,632 —-a-w C:\WINDOWS\system32\softpub.dll 2002-08-29 12:00:00 5,632 —-a-w C:\WINDOWS\system32\skdll.dll 2002-08-29 12:00:00 5,632 —-a-w C:\WINDOWS\system32\mll_qic.dll 2002-08-29 12:00:00 5,120 —-a-w C:\WINDOWS\system32\winnls.dll 2002-08-29 12:00:00 5,120 —-a-w C:\WINDOWS\system32\shell.dll 2002-08-29 12:00:00 5,120 —-a-w C:\WINDOWS\system32\lodctr.exe 2002-08-29 12:00:00 5,120 —-a-w C:\WINDOWS\system32\dcomcnfg.exe 2002-08-29 12:00:00 5,120 —-a-w C:\WINDOWS\system32\bootvrfy.exe 2002-08-29 12:00:00 49,680 —-a-w C:\WINDOWS\twunk_16.exe 2002-08-29 12:00:00 49,664 —-a-w C:\WINDOWS\system32\w32tm.exe 2002-08-29 12:00:00 49,179 —-a-w C:\WINDOWS\system32\sqlwoa.dll 2002-08-29 12:00:00 49,152 —-a-w C:\WINDOWS\system32\rsmui.exe 2002-08-29 12:00:00 49,152 —-a-w C:\WINDOWS\system32\rsm.exe 2002-08-29 12:00:00 49,152 —-a-w C:\WINDOWS\system32\mprdim.dll 2002-08-29 12:00:00 47,952 —-a-w C:\WINDOWS\system32\jobexec.dll 2002-08-29 12:00:00 47,872 —-a-w C:\WINDOWS\system32\user.exe 2002-08-29 12:00:00 47,616 —-a-w C:\WINDOWS\system32\d3dxof.dll 2002-08-29 12:00:00 47,104 —-a-w C:\WINDOWS\system32\mprui.dll 2002-08-29 12:00:00 46,592 —-a-w C:\WINDOWS\system32\pmspl.dll 2002-08-29 12:00:00 46,258 —-a-w C:\WINDOWS\system32\mib.bin 2002-08-29 12:00:00 46,080 —-a-w C:\WINDOWS\system32\docprop.dll 2002-08-29 12:00:00 450,560 —-a-w C:\WINDOWS\system32\infosoft.dll 2002-08-29 12:00:00 45,568 —-a-w C:\WINDOWS\system32\jgsd400.dll 2002-08-29 12:00:00 45,568 —-a-w C:\WINDOWS\system32\drwtsn32.exe 2002-08-29 12:00:00 45,083 —-a-w C:\WINDOWS\system32\dispex.dll 2002-08-29 12:00:00 446,464 —-a-w C:\WINDOWS\system32\wmvdmoe.dll 2002-08-29 12:00:00 44,544 —-a-w C:\WINDOWS\system32\jgaw400.dll 2002-08-29 12:00:00 44,544 —-a-w C:\WINDOWS\system32\hticons.dll 2002-08-29 12:00:00 44,032 —-a-w C:\WINDOWS\system32\ipsec6.exe 2002-08-29 12:00:00 44,032 —-a-w C:\WINDOWS\system32\dimap.dll 2002-08-29 12:00:00 436,224 —-a-w C:\WINDOWS\system32\d3dim.dll 2002-08-29 12:00:00 42,809 —-a-w C:\WINDOWS\system32\key01.sys 2002-08-29 12:00:00 42,768 —-a-w C:\WINDOWS\system32\dpwsock.dll 2002-08-29 12:00:00 42,537 —-a-w C:\WINDOWS\system32\keyboard.sys 2002-08-29 12:00:00 414,208 —-a-w C:\WINDOWS\system32\setupdll.dll 2002-08-29 12:00:00 41,984 —-a-w C:\WINDOWS\system32\msports.dll 2002-08-29 12:00:00 41,472 —-a-w C:\WINDOWS\system32\iasads.dll 2002-08-29 12:00:00 40,448 —-a-w C:\WINDOWS\system32\webhits.dll 2002-08-29 12:00:00 40,448 —-a-w C:\WINDOWS\system32\osuninst.exe 2002-08-29 12:00:00 4,768 —-a-w C:\WINDOWS\system32\himem.sys 2002-08-29 12:00:00 4,736 —-a-w C:\WINDOWS\system32\drivers\usbd.sys 2002-08-29 12:00:00 4,608 —-a-w C:\WINDOWS\system32\vjoy.dll 2002-08-29 12:00:00 4,608 —-a-w C:\WINDOWS\system32\regwiz.exe 2002-08-29 12:00:00 4,608 —-a-w C:\WINDOWS\system32\mssip32.dll 2002-08-29 12:00:00 4,608 —-a-w C:\WINDOWS\system32\mchgrcoi.dll 2002-08-29 12:00:00 4,608 —-a-w C:\WINDOWS\system32\dllhst3g.exe 2002-08-29 12:00:00 4,608 —-a-w C:\WINDOWS\system32\bootok.exe 2002-08-29 12:00:00 4,352 —-a-w C:\WINDOWS\system32\drivers\wmilib.sys 2002-08-29 12:00:00 4,224 —-a-w C:\WINDOWS\system32\drivers\rdpcdd.sys 2002-08-29 12:00:00 4,224 —-a-w C:\WINDOWS\system32\drivers\mnmdd.sys 2002-08-29 12:00:00 4,224 —-a-w C:\WINDOWS\system32\drivers\beep.sys 2002-08-29 12:00:00 4,208 —-a-w C:\WINDOWS\system32\storage.dll 2002-08-29 12:00:00 4,096 —-a-w C:\WINDOWS\system32\unlodctr.exe 2002-08-29 12:00:00 4,096 —-a-w C:\WINDOWS\system32\rdpcfgex.dll 2002-08-29 12:00:00 4,096 —-a-w C:\WINDOWS\system32\mtxex.dll 2002-08-29 12:00:00 4,096 —-a-w C:\WINDOWS\system32\iprtprio.dll 2002-08-29 12:00:00 394,240 —-a-w C:\WINDOWS\system32\diactfrm.dll 2002-08-29 12:00:00 39,936 —-a-w C:\WINDOWS\system32\ipxrtmgr.dll 2002-08-29 12:00:00 39,744 —-a-w C:\WINDOWS\system32\ole2.dll 2002-08-29 12:00:00 39,424 —-a-w C:\WINDOWS\system32\esentutl.exe 2002-08-29 12:00:00 39,424 —-a-w C:\WINDOWS\system32\ddeml.dll 2002-08-29 12:00:00 39,274 —-a-w C:\WINDOWS\system32\mem.exe 2002-08-29 12:00:00 38,016 —-a-w C:\WINDOWS\system32\drivers\ndproxy.sys 2002-08-29 12:00:00 370,176 —-a-w C:\WINDOWS\system32\dhcpmon.dll 2002-08-29 12:00:00 37,916 —-a-w C:\WINDOWS\system32\msxml2r.dll 2002-08-29 12:00:00 368,710 —-a-w C:\WINDOWS\system32\msisam11.dll 2002-08-29 12:00:00 362,496 —-a-w C:\WINDOWS\system32\jet500.dll 2002-08-29 12:00:00 36,864 —-a-w C:\WINDOWS\system32\syskey.exe 2002-08-29 12:00:00 36,864 —-a-w C:\WINDOWS\system32\ntmsevt.dll 2002-08-29 12:00:00 359,936 —-a-w C:\WINDOWS\system32\cards.dll 2002-08-29 12:00:00 352,256 —-a-w C:\WINDOWS\system32\drivers\atmuni.sys 2002-08-29 12:00:00 350,208 —-a-w C:\WINDOWS\system32\d3drm.dll 2002-08-29 12:00:00 35,840 —-a-w C:\WINDOWS\system32\narrhook.dll 2002-08-29 12:00:00 35,840 —-a-w C:\WINDOWS\system32\mssign32.dll 2002-08-29 12:00:00 35,840 —-a-w C:\WINDOWS\system32\jgmd400.dll 2002-08-29 12:00:00 35,840 —-a-w C:\WINDOWS\system32\drivers\isapnp.sys 2002-08-29 12:00:00 35,328 —-a-w C:\WINDOWS\system32\winchat.exe 2002-08-29 12:00:00 35,328 —-a-w C:\WINDOWS\system32\pifmgr.dll 2002-08-29 12:00:00 345,600 —-a-w C:\WINDOWS\system32\confmsp.dll 2002-08-29 12:00:00 34,944 —-a-w C:\WINDOWS\system32\drivers\fips.sys 2002-08-29 12:00:00 34,816 —-a-w C:\WINDOWS\system32\d3dpmesh.dll 2002-08-29 12:00:00 34,816 —-a-w C:\WINDOWS\system32\atmpvcno.dll 2002-08-29 12:00:00 34,432 —-a-w C:\WINDOWS\system32\drivers\rawwan.sys 2002-08-29 12:00:00 330,752 —-a-w C:\WINDOWS\system32\dmconfig.dll 2002-08-29 12:00:00 33,792 —-a-w C:\WINDOWS\system32\vssadmin.exe 2002-08-29 12:00:00 33,792 —-a-w C:\WINDOWS\system32\regini.exe 2002-08-29 12:00:00 33,280 —-a-w C:\WINDOWS\system32\ping6.exe 2002-08-29 12:00:00 33,280 —-a-w C:\WINDOWS\system32\msobjs.dll 2002-08-29 12:00:00 33,280 —-a-w C:\WINDOWS\system32\eventcls.dll 2002-08-29 12:00:00 33,040 —-a-w C:\WINDOWS\system32\dplay.dll 2002-08-29 12:00:00 32,896 —-a-w C:\WINDOWS\system32\drivers\ipfltdrv.sys 2002-08-29 12:00:00 32,816 —-a-w C:\WINDOWS\system32\commdlg.dll 2002-08-29 12:00:00 32,768 —-a-w C:\WINDOWS\system32\cnetcfg.dll 2002-08-29 12:00:00 32,512 —-a-w C:\WINDOWS\system32\drivers\nwlnkfwd.sys 2002-08-29 12:00:00 32,256 —-a-w C:\WINDOWS\system32\wupdmgr.exe 2002-08-29 12:00:00 32,256 —-a-w C:\WINDOWS\system32\iashlpr.dll 2002-08-29 12:00:00 311,327 —-a-w C:\WINDOWS\system32\wmv8dmod.dll 2002-08-29 12:00:00 31,744 —-a-w C:\WINDOWS\system32\tracert6.exe 2002-08-29 12:00:00 31,744 —-a-w C:\WINDOWS\system32\fxsroute.dll 2002-08-29 12:00:00 31,360 —-a-w C:\WINDOWS\system32\drivers\atmepvc.sys 2002-08-29 12:00:00 31,232 —-a-w C:\WINDOWS\system32\traffic.dll 2002-08-29 12:00:00 31,232 —-a-w C:\WINDOWS\system32\sc.exe 2002-08-29 12:00:00 308,224 —-a-w C:\WINDOWS\system32\netui2.dll 2002-08-29 12:00:00 30,720 —-a-w C:\WINDOWS\system32\plustab.dll 2002-08-29 12:00:00 30,720 —-a-w C:\WINDOWS\system32\iologmsg.dll 2002-08-29 12:00:00 30,160 —-a-w C:\WINDOWS\system32\compobj.dll 2002-08-29 12:00:00 3,708 —-a-w C:\WINDOWS\system32\pubprn.vbs 2002-08-29 12:00:00 3,584 —-a-w C:\WINDOWS\system32\riched32.dll 2002-08-29 12:00:00 3,584 —-a-w C:\WINDOWS\system32\regedt32.exe 2002-08-29 12:00:00 3,584 —-a-w C:\WINDOWS\system32\mll_hp.dll 2002-08-29 12:00:00 3,584 —-a-w C:\WINDOWS\system32\iprop.dll 2002-08-29 12:00:00 3,584 —-a-w C:\WINDOWS\system32\comcat.dll 2002-08-29 12:00:00 3,456 —-a-w C:\WINDOWS\system32\drivers\oprghdlr.sys 2002-08-29 12:00:00 3,328 —-a-w C:\WINDOWS\system32\drivers\pciide.sys 2002-08-29 12:00:00 3,328 —-a-w C:\WINDOWS\system32\drivers\dxgthk.sys 2002-08-29 12:00:00 3,072 —-a-w C:\WINDOWS\system32\systray.exe 2002-08-29 12:00:00 3,072 —-a-w C:\WINDOWS\system32\rnr20.dll 2002-08-29 12:00:00 3,072 —-a-w C:\WINDOWS\system32\fixmapi.exe 2002-08-29 12:00:00 29,696 —-a-w C:\WINDOWS\system32\lights.exe 2002-08-29 12:00:00 29,370 —-a-w C:\WINDOWS\system32\ntdos411.sys 2002-08-29 12:00:00 29,274 —-a-w C:\WINDOWS\system32\ntdos412.sys 2002-08-29 12:00:00 29,146 —-a-w C:\WINDOWS\system32\ntdos804.sys 2002-08-29 12:00:00 29,146 —-a-w C:\WINDOWS\system32\ntdos404.sys 2002-08-29 12:00:00 285,184 —-a-w C:\WINDOWS\system32\glmf32.dll 2002-08-29 12:00:00 28,746 —-a-w C:\WINDOWS\system32\msrecr40.dll 2002-08-29 12:00:00 28,626 —-a-w C:\WINDOWS\system32\perfd009.dat 2002-08-29 12:00:00 28,112 —-a-w C:\WINDOWS\system32\drwatson.exe 2002-08-29 12:00:00 273,920 —-a-w C:\WINDOWS\system32\dmdlgs.dll 2002-08-29 12:00:00 272,128 —-a-w C:\WINDOWS\system32\perfi009.dat 2002-08-29 12:00:00 27,866 —-a-w C:\WINDOWS\system32\ntdos.sys 2002-08-29 12:00:00 27,648 —-a-w C:\WINDOWS\system32\ccfgnt.dll 2002-08-29 12:00:00 27,200 —-a-r C:\WINDOWS\system32\ctl3dv2.dll 2002-08-29 12:00:00 27,136 —-a-w C:\WINDOWS\system32\ctl3d32.dll 2002-08-29 12:00:00 27,097 —-a-w C:\WINDOWS\system32\country.sys 2002-08-29 12:00:00 26,624 —-a-w C:\WINDOWS\system32\scredir.dll 2002-08-29 12:00:00 26,624 —-a-w C:\WINDOWS\system32\msxmlr.dll 2002-08-29 12:00:00 26,624 —-a-w C:\WINDOWS\system32\cnvfat.dll 2002-08-29 12:00:00 26,112 —-a-w C:\WINDOWS\system32\graftabl.com 2002-08-29 12:00:00 26,112 —-a-w C:\WINDOWS\system32\adptif.dll 2002-08-29 12:00:00 256,192 —-a-w C:\WINDOWS\winhelp.exe 2002-08-29 12:00:00 253,952 —-a-w C:\WINDOWS\system32\neth.dll 2002-08-29 12:00:00 253,952 —-a-w C:\WINDOWS\system32\msvcrt20.dll 2002-08-29 12:00:00 25,600 —-a-w C:\WINDOWS\twunk_32.exe 2002-08-29 12:00:00 25,600 —-a-w C:\WINDOWS\system32\utildll.dll 2002-08-29 12:00:00 25,600 —-a-w C:\WINDOWS\system32\routemon.exe 2002-08-29 12:00:00 25,600 —-a-w C:\WINDOWS\system32\msvidc32.dll 2002-08-29 12:00:00 25,600 —-a-w C:\WINDOWS\system32\format.com 2002-08-29 12:00:00 25,600 —-a-w C:\WINDOWS\system32\comaddin.dll 2002-08-29 12:00:00 25,600 —-a-w C:\WINDOWS\system32\aaaamon.dll 2002-08-29 12:00:00 25,088 —-a-w C:\WINDOWS\system32\mtxlegih.dll 2002-08-29 12:00:00 25,088 —-a-w C:\WINDOWS\system32\lnkstub.exe 2002-08-29 12:00:00 247,808 —-a-w C:\WINDOWS\system32\iassdo.dll 2002-08-29 12:00:00 241,725 —-a-w C:\WINDOWS\system32\msuni11.dll 2002-08-29 12:00:00 24,661 —-a-w C:\WINDOWS\system32\spxcoins.dll 2002-08-29 12:00:00 24,603 —-a-w C:\WINDOWS\system32\sqlwid.dll 2002-08-29 12:00:00 24,576 —-a-w C:\WINDOWS\system32\rsmsink.exe 2002-08-29 12:00:00 24,576 —-a-w C:\WINDOWS\system32\gdi.exe 2002-08-29 12:00:00 24,064 —-a-w C:\WINDOWS\system32\olesvr.dll 2002-08-29 12:00:00 23,552 —-a-w C:\WINDOWS\system32\sort.exe 2002-08-29 12:00:00 23,552 —-a-w C:\WINDOWS\system32\sfmapi.dll 2002-08-29 12:00:00 23,552 —-a-w C:\WINDOWS\system32\rsvpmsg.dll 2002-08-29 12:00:00 23,552 —-a-w C:\WINDOWS\system32\rasrad.dll 2002-08-29 12:00:00 23,552 —-a-w C:\WINDOWS\system32\iasacct.dll 2002-08-29 12:00:00 227,840 —-a-w C:\WINDOWS\system32\avtapi.dll 2002-08-29 12:00:00 22,528 —-a-w C:\WINDOWS\system32\rasmxs.dll 2002-08-29 12:00:00 22,016 —-a-w C:\WINDOWS\system32\w32topl.dll 2002-08-29 12:00:00 22,016 —-a-w C:\WINDOWS\system32\rpcns4.dll 2002-08-29 12:00:00 22,016 —-a-w C:\WINDOWS\system32\qwinsta.exe 2002-08-29 12:00:00 22,016 —-a-w C:\WINDOWS\system32\olesvr32.dll 2002-08-29 12:00:00 22,016 —-a-w C:\WINDOWS\system32\mpnotify.exe 2002-08-29 12:00:00 218,003 —-a-w C:\WINDOWS\system32\dssec.dat 2002-08-29 12:00:00 214,016 —-a-w C:\WINDOWS\system32\netevent.dll 2002-08-29 12:00:00 21,504 —-a-w C:\WINDOWS\system32\pathping.exe 2002-08-29 12:00:00 21,504 —-a-w C:\WINDOWS\system32\ipxrip.dll 2002-08-29 12:00:00 208,896 —-a-w C:\WINDOWS\system32\wavemsp.dll 2002-08-29 12:00:00 20,992 —-a-w C:\WINDOWS\system32\msg.exe 2002-08-29 12:00:00 20,992 —-a-w C:\WINDOWS\system32\ipxwan.dll 2002-08-29 12:00:00 20,634 —-a-w C:\WINDOWS\system32\debug.exe 2002-08-29 12:00:00 20,535 —-a-w C:\WINDOWS\system32\vfpodbc.dll 2002-08-29 12:00:00 20,480 —-a-w C:\WINDOWS\system32\nbtstat.exe 2002-08-29 12:00:00 20,480 —-a-w C:\WINDOWS\system32\mtxdm.dll 2002-08-29 12:00:00 2,944 —-a-w C:\WINDOWS\system32\drivers\null.sys 2002-08-29 12:00:00 2,864 —-a-w C:\WINDOWS\system32\winsock.dll 2002-08-29 12:00:00 2,736 —-a-w C:\WINDOWS\system32\wowdeb.exe 2002-08-29 12:00:00 2,560 —-a-w C:\WINDOWS\system32\lz32.dll 2002-08-29 12:00:00 2,112 —-a-w C:\WINDOWS\system32\winspool.exe 2002-08-29 12:00:00 199,168 —-a-w C:\WINDOWS\system32\ir32_32.dll 2002-08-29 12:00:00 19,968 —-a-w C:\WINDOWS\system32\route.exe 2002-08-29 12:00:00 19,694 —-a-w C:\WINDOWS\system32\graphics.com 2002-08-29 12:00:00 19,456 —-a-w C:\WINDOWS\system32\tcpsvcs.exe 2002-08-29 12:00:00 19,456 —-a-w C:\WINDOWS\system32\mode.com 2002-08-29 12:00:00 19,456 —-a-w C:\WINDOWS\system32\dmocx.dll 2002-08-29 12:00:00 19,456 —-a-w C:\WINDOWS\system32\arp.exe 2002-08-29 12:00:00 19,200 —-a-w C:\WINDOWS\system32\tapi.dll 2002-08-29 12:00:00 18,944 —-a-w C:\WINDOWS\vmmreg32.dll 2002-08-29 12:00:00 18,944 —-a-w C:\WINDOWS\system32\wmiprop.dll 2002-08-29 12:00:00 18,944 —-a-w C:\WINDOWS\system32\winstrm.dll 2002-08-29 12:00:00 18,944 —-a-w C:\WINDOWS\system32\mimefilt.dll 2002-08-29 12:00:00 18,896 —-a-w C:\WINDOWS\system32\sysedit.exe 2002-08-29 12:00:00 18,688 —-a-w C:\WINDOWS\system32\drivers\partmgr.sys 2002-08-29 12:00:00 18,432 —-a-w C:\WINDOWS\system32\win.com 2002-08-29 12:00:00 18,432 —-a-w C:\WINDOWS\system32\dmintf.dll 2002-08-29 12:00:00 18,432 —-a-w C:\WINDOWS\system32\deskperf.dll 2002-08-29 12:00:00 18,432 —-a-w C:\WINDOWS\system32\cacls.exe 2002-08-29 12:00:00 18,176 —-a-w C:\WINDOWS\system32\vga64k.dll 2002-08-29 12:00:00 177,856 —-a-w C:\WINDOWS\system32\typelib.dll 2002-08-29 12:00:00 176,157 —-a-w C:\WINDOWS\system32\dgrpsetu.dll 2002-08-29 12:00:00 176,128 —-a-w C:\WINDOWS\system32\ftsrch.dll 2002-08-29 12:00:00 171,008 —-a-w C:\WINDOWS\system32\netmsg.dll 2002-08-29 12:00:00 17,920 —-a-w C:\WINDOWS\system32\ureg.dll 2002-08-29 12:00:00 17,920 —-a-w C:\WINDOWS\system32\iaspolcy.dll 2002-08-29 12:00:00 17,920 —-a-w C:\WINDOWS\system32\diskperf.exe 2002-08-29 12:00:00 17,792 —-a-w C:\WINDOWS\system32\drivers\ptilink.sys 2002-08-29 12:00:00 17,408 —-a-w C:\WINDOWS\system32\mcicda.dll 2002-08-29 12:00:00 17,408 —-a-w C:\WINDOWS\system32\esentprf.dll 2002-08-29 12:00:00 17,408 —-a-w C:\WINDOWS\system32\compact.exe 2002-08-29 12:00:00 169,984 —-a-w C:\WINDOWS\system32\sccbase.dll 2002-08-29 12:00:00 169,984 —-a-w C:\WINDOWS\system32\iprtrmgr.dll 2002-08-29 12:00:00 169,520 —-a-w C:\WINDOWS\system32\ole2disp.dll 2002-08-29 12:00:00 163,840 —-a-w C:\WINDOWS\system32\mindex.dll 2002-08-29 12:00:00 163,328 —-a-w C:\WINDOWS\system32\oleacc.dll 2002-08-29 12:00:00 163,328 —-a-w C:\WINDOWS\system32\ciadmin.dll 2002-08-29 12:00:00 16,896 —-a-w C:\WINDOWS\system32\vss_ps.dll 2002-08-29 12:00:00 16,896 —-a-w C:\WINDOWS\system32\tsshutdn.exe 2002-08-29 12:00:00 16,896 —-a-w C:\WINDOWS\system32\tftp.exe 2002-08-29 12:00:00 16,896 —-a-w C:\WINDOWS\system32\qappsrv.exe 2002-08-29 12:00:00 16,896 —-a-w C:\WINDOWS\system32\perfnet.dll 2002-08-29 12:00:00 16,896 —-a-w C:\WINDOWS\system32\oleaccrc.dll 2002-08-29 12:00:00 16,896 —-a-w C:\WINDOWS\system32\deskmon.dll 2002-08-29 12:00:00 16,512 —-a-w C:\WINDOWS\system32\drivers\raspti.sys 2002-08-29 12:00:00 16,384 —-a-w C:\WINDOWS\system32\tskill.exe 2002-08-29 12:00:00 16,384 —-a-w C:\WINDOWS\system32\runas.exe 2002-08-29 12:00:00 16,384 —-a-w C:\WINDOWS\system32\prflbmsg.dll 2002-08-29 12:00:00 16,384 —-a-w C:\WINDOWS\system32\icfgnt5.dll 2002-08-29 12:00:00 16,384 —-a-w C:\WINDOWS\system32\fmifs.dll 2002-08-29 12:00:00 16,384 —-a-w C:\WINDOWS\system32\deskadp.dll 2002-08-29 12:00:00 16,384 —-a-w C:\WINDOWS\system32\avmeter.dll 2002-08-29 12:00:00 154,112 —-a-w C:\WINDOWS\system32\ipmontr.dll 2002-08-29 12:00:00 153,008 —-a-w C:\WINDOWS\system32\ole2nls.dll 2002-08-29 12:00:00 152,064 —-a-w C:\WINDOWS\system32\datime.dll 2002-08-29 12:00:00 15,872 —-a-w C:\WINDOWS\system32\sysinv.dll 2002-08-29 12:00:00 15,872 —-a-w C:\WINDOWS\system32\rwinsta.exe 2002-08-29 12:00:00 15,872 —-a-w C:\WINDOWS\system32\more.com 2002-08-29 12:00:00 15,872 —-a-w C:\WINDOWS\system32\comp.exe 2002-08-29 12:00:00 15,872 —-a-w C:\WINDOWS\system32\cdmodem.dll 2002-08-29 12:00:00 15,360 —-a-w C:\WINDOWS\TASKMAN.EXE 2002-08-29 12:00:00 15,360 —-a-w C:\WINDOWS\system32\tsd32.dll 2002-08-29 12:00:00 15,360 —-a-w C:\WINDOWS\system32\taskman.exe 2002-08-29 12:00:00 15,360 —-a-w C:\WINDOWS\system32\pentnt.exe 2002-08-29 12:00:00 15,360 —-a-w C:\WINDOWS\system32\logoff.exe 2002-08-29 12:00:00 149,019 —-a-w C:\WINDOWS\system32\crtdll.dll 2002-08-29 12:00:00 147,456 —-a-w C:\WINDOWS\system32\comsnap.dll 2002-08-29 12:00:00 145,408 —-a-w C:\WINDOWS\system32\wiavusd.dll 2002-08-29 12:00:00 144,384 —-a-w C:\WINDOWS\system32\dskquoui.dll 2002-08-29 12:00:00 143,360 —-a-w C:\WINDOWS\system32\rasmontr.dll 2002-08-29 12:00:00 142,848 —-a-w C:\WINDOWS\system32\capesnpn.dll 2002-08-29 12:00:00 141,312 —-a-w C:\WINDOWS\system32\iasrecst.dll 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\tsdiscon.exe 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\tscon.exe 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\slbrccsp.dll 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\shadow.exe 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\serwvdrv.dll 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\msidntld.dll 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\hnetmon.dll 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\help.exe 2002-08-29 12:00:00 14,848 —-a-w C:\WINDOWS\system32\fc.exe 2002-08-29 12:00:00 14,710 —-a-w C:\WINDOWS\system32\kb16.com 2002-08-29 12:00:00 14,592 —-a-w C:\WINDOWS\system32\drivers\smclib.sys 2002-08-29 12:00:00 14,336 —-a-w C:\WINDOWS\system32\serialui.dll 2002-08-29 12:00:00 14,336 —-a-w C:\WINDOWS\system32\ntlanui2.dll 2002-08-29 12:00:00 14,336 —-a-w C:\WINDOWS\system32\cmpbk32.dll 2002-08-29 12:00:00 138,752 —-a-w C:\WINDOWS\system32\swprv.dll 2002-08-29 12:00:00 138,752 —-a-w C:\WINDOWS\system32\sndvol32.exe 2002-08-29 12:00:00 132,608 —-a-w C:\WINDOWS\system32\rsvp.exe 2002-08-29 12:00:00 132,608 —-a-w C:\WINDOWS\system32\fxsclntR.dll 2002-08-29 12:00:00 130,048 —-a-w C:\WINDOWS\system32\sdpblb.dll 2002-08-29 12:00:00 13,952 —-a-w C:\WINDOWS\system32\drivers\cbidf2k.sys 2002-08-29 12:00:00 13,888 —-a-w C:\WINDOWS\system32\toolhelp.dll 2002-08-29 12:00:00 13,824 —-a-w C:\WINDOWS\system32\sisbkup.dll 2002-08-29 12:00:00 13,824 —-a-w C:\WINDOWS\system32\senscfg.dll 2002-08-29 12:00:00 13,824 —-a-w C:\WINDOWS\system32\convert.exe 2002-08-29 12:00:00 13,312 —-a-w C:\WINDOWS\system32\win87em.dll 2002-08-29 12:00:00 13,312 —-a-w C:\WINDOWS\system32\verifier.dll 2002-08-29 12:00:00 13,312 —-a-w C:\WINDOWS\system32\umdmxfrm.dll 2002-08-29 12:00:00 13,312 —-a-w C:\WINDOWS\system32\ntvdmd.dll 2002-08-29 12:00:00 13,312 —-a-w C:\WINDOWS\system32\msswch.dll 2002-08-29 12:00:00 13,312 —-a-w C:\WINDOWS\system32\irclass.dll 2002-08-29 12:00:00 13,312 —-a-w C:\WINDOWS\system32\atkctrs.dll 2002-08-29 12:00:00 129,536 —-a-w C:\WINDOWS\system32\acledit.dll 2002-08-29 12:00:00 126,976 —-a-w C:\WINDOWS\system32\mshearts.exe 2002-08-29 12:00:00 126,912 —-a-w C:\WINDOWS\system32\msvideo.dll 2002-08-29 12:00:00 125,056 —-a-w C:\WINDOWS\system32\drivers\ftdisk.sys 2002-08-29 12:00:00 12,800 —-a-w C:\WINDOWS\system32\replace.exe 2002-08-29 12:00:00 12,800 —-a-w C:\WINDOWS\system32\rasser.dll 2002-08-29 12:00:00 12,800 —-a-w C:\WINDOWS\system32\mrinfo.exe 2002-08-29 12:00:00 12,642 —-a-w C:\WINDOWS\system32\edlin.exe 2002-08-29 12:00:00 12,498 —-a-w C:\WINDOWS\system32\append.exe 2002-08-29 12:00:00 12,416 —-a-w C:\WINDOWS\system32\drivers\nwlnkflt.sys 2002-08-29 12:00:00 12,288 —-a-w C:\WINDOWS\system32\tcmsetup.exe 2002-08-29 12:00:00 12,288 —-a-w C:\WINDOWS\system32\perfts.dll 2002-08-29 12:00:00 12,288 —-a-w C:\WINDOWS\system32\nmevtmsg.dll 2002-08-29 12:00:00 12,288 —-a-w C:\WINDOWS\system32\mmdrv.dll 2002-08-29 12:00:00 12,288 —-a-w C:\WINDOWS\system32\bootvid.dll 2002-08-29 12:00:00 12,032 —-a-w C:\WINDOWS\system32\drivers\ws2ifsl.sys 2002-08-29 12:00:00 119,808 —-a-w C:\WINDOWS\system32\winmine.exe 2002-08-29 12:00:00 119,808 —-a-w C:\WINDOWS\system32\mmutilse.dll 2002-08-29 12:00:00 118,784 —-a-w C:\WINDOWS\system32\scardssp.dll 2002-08-29 12:00:00 118,784 —-a-w C:\WINDOWS\system32\dmdskres.dll 2002-08-29 12:00:00 114,688 —-a-w C:\WINDOWS\system32\calc.exe 2002-08-29 12:00:00 112,128 —-a-w C:\WINDOWS\system32\mapistub.dll 2002-08-29 12:00:00 112,128 —-a-w C:\WINDOWS\system32\mapi32.dll 2002-08-29 12:00:00 111,104 —-a-w C:\WINDOWS\system32\fxscfgwz.dll 2002-08-29 12:00:00 110,592 —-a-w C:\WINDOWS\system32\inetcplc.dll 2002-08-29 12:00:00 11,776 —-a-w C:\WINDOWS\system32\wshisn.dll 2002-08-29 12:00:00 11,776 —-a-w C:\WINDOWS\system32\winmsd.exe 2002-08-29 12:00:00 11,776 —-a-w C:\WINDOWS\system32\rasctrs.dll 2002-08-29 12:00:00 11,776 —-a-w C:\WINDOWS\system32\rasautou.exe 2002-08-29 12:00:00 11,776 —-a-w C:\WINDOWS\system32\chkdsk.exe 2002-08-29 12:00:00 11,753 —-a-w C:\WINDOWS\system32\setver.exe 2002-08-29 12:00:00 11,648 —-a-w C:\WINDOWS\system32\drivers\acpiec.sys 2002-08-29 12:00:00 11,264 —-a-w C:\WINDOWS\system32\tree.com 2002-08-29 12:00:00 11,264 —-a-w C:\WINDOWS\system32\rasdial.exe 2002-08-29 12:00:00 11,264 —-a-w C:\WINDOWS\system32\fxssend.exe 2002-08-29 12:00:00 11,264 —-a-w C:\WINDOWS\system32\chkntfs.exe 2002-08-29 12:00:00 11,264 —-a-w C:\WINDOWS\system32\attrib.exe 2002-08-29 12:00:00 11,264 —-a-w C:\WINDOWS\system32\atrace.dll 2002-08-29 12:00:00 109,568 —-a-w C:\WINDOWS\system32\cic.dll 2002-08-29 12:00:00 109,456 —-a-w C:\WINDOWS\system32\avifile.dll 2002-08-29 12:00:00 108,464 —-a-w C:\WINDOWS\system32\netapi.dll 2002-08-29 12:00:00 107,520 —-a-w C:\WINDOWS\system32\rend.dll 2002-08-29 12:00:00 103,424 —-a-w C:\WINDOWS\system32\EqnClass.Dll 2002-08-29 12:00:00 102,912 —-a-w C:\WINDOWS\system32\msaatext.dll 2002-08-29 12:00:00 102,912 —-a-w C:\WINDOWS\system32\apcups.dll 2002-08-29 12:00:00 101,888 —-a-w C:\WINDOWS\system32\gpkcsp.dll 2002-08-29 12:00:00 10,752 —-a-w C:\WINDOWS\system32\pschdprf.dll 2002-08-29 12:00:00 10,752 —-a-w C:\WINDOWS\system32\doskey.exe 2002-08-29 12:00:00 10,752 —-a-w C:\WINDOWS\system32\clb.dll 2002-08-29 12:00:00 10,496 —-a-w C:\WINDOWS\system32\mcdsrv32.dll 2002-08-29 12:00:00 10,496 —-a-w C:\WINDOWS\system32\drivers\dxapi.sys 2002-08-29 12:00:00 10,368 —-a-w C:\WINDOWS\system32\wowexec.exe 2002-08-29 12:00:00 10,240 —-a-w C:\WINDOWS\system32\panmap.dll 2002-08-29 12:00:00 10,240 —-a-w C:\WINDOWS\system32\mcd32.dll 2002-08-29 12:00:00 10,112 —-a-w C:\WINDOWS\system32\modex.dll 2002-08-29 12:00:00 1,677,312 —-a-w C:\WINDOWS\system32\wmvcore2.dll 2002-08-29 12:00:00 1,501,696 —-a-w C:\WINDOWS\system32\diskcopy.dll 2002-08-29 12:00:00 1,355,776 —-a-w C:\WINDOWS\system32\msvbvm50.dll 2002-08-29 12:00:00 1,161 —-a-w C:\WINDOWS\system32\usrlogon.cmd 2002-08-29 12:00:00 1,131 —-a-w C:\WINDOWS\system32\loadfix.com 2002-08-29 12:00:00 1,114,896 —-a-w C:\WINDOWS\system32\esent97.dll 2002-08-21 19:13:12 189,952 —-a-w C:\WINDOWS\system32\WISPTIS.EXE 2002-08-21 19:10:16 204,800 —-a-w C:\WINDOWS\system32\INKED.DLL 2002-08-01 03:28:38 81,920 —-a-w C:\WINDOWS\system32\ps2.EXE 2002-08-01 03:28:38 81,920 —-a-w C:\WINDOWS\system32\ps2.bat 2002-07-30 05:43:50 23,808 —-a-w C:\WINDOWS\system32\drivers\PS2.sys 2002-06-20 17:25:16 76,288 —-a-r C:\WINDOWS\system32\Pubole32.dll 2002-06-20 17:22:42 5,632 —-a-r C:\WINDOWS\system32\mfcuia32.dll 2002-06-20 17:22:42 31,744 —-a-r C:\WINDOWS\system32\hlp95en.dll 2002-06-20 17:22:42 133,904 —-a-r C:\WINDOWS\system32\mfcans32.dll 2002-06-20 17:19:18 37,888 —-a-r C:\WINDOWS\system32\ochlp30e.dll 2002-06-20 17:19:12 91,136 —-a-r C:\WINDOWS\system32\msls2.dll 2002-04-27 08:27:24 49,152 —-a-w C:\WINDOWS\system32\sis740.bin 2002-04-27 08:27:12 49,152 —-a-w C:\WINDOWS\system32\sis650.bin 2002-04-25 02:42:18 364,544 —-a-w C:\WINDOWS\system32\LCodcCMP.dll 2002-04-11 18:47:52 49,152 —-a-w C:\WINDOWS\system32\msmscoin.dll 2002-04-11 18:47:52 11,136 —-a-w C:\WINDOWS\system32\drivers\ipfilter.sys 2002-04-10 09:34:36 839,729 —-a-w C:\WINDOWS\system32\python22.dll 2002-03-20 11:05:36 45,056 —-a-w C:\WINDOWS\system32\hpreg.dll 2002-02-04 16:43:00 82,432 —-a-w C:\WINDOWS\system32\msxml4r.dll 2002-01-19 05:44:14 299,073 —-a-w C:\WINDOWS\system32\PythonCOM22.dll 2002-01-19 05:44:12 65,536 —-a-w C:\WINDOWS\system32\PyWinTypes22.dll 2002-01-05 18:37:26 344,064 —-a-w C:\WINDOWS\system32\msvcr70.dll 2002-01-05 18:36:38 964,608 —-a-w C:\WINDOWS\system32\mfc70u.dll 2002-01-05 17:40:20 487,424 —-a-w C:\WINDOWS\system32\msvcp70.dll 2001-11-05 14:23:52 299,923 —-a-w C:\WINDOWS\system32\drivers\sonyhcs.sys 2001-11-05 14:23:20 38,739 —-a-w C:\WINDOWS\system32\drivers\sonyhcc.sys 2001-11-05 14:23:14 6,097 —-a-w C:\WINDOWS\system32\drivers\sonyhcb.sys 2001-09-06 11:00:58 1,700,352 —-a-w C:\WINDOWS\system32\gdiplus.dll 2001-09-05 18:47:20 794,624 —-a-w C:\WINDOWS\system32\PMAppBuilder.dll 2001-09-05 18:46:58 102,400 —-a-w C:\WINDOWS\system32\PMovieServer.dll 2001-09-05 18:46:50 45,056 —-a-w C:\WINDOWS\system32\ImportClient.dll 2001-09-05 18:46:46 90,112 —-a-w C:\WINDOWS\system32\ImageServerMI.dll 2001-09-05 18:46:00 53,248 —-a-w C:\WINDOWS\system32\PretzelSpellCheck.dll 2001-09-05 02:49:32 24,576 —-a-w C:\WINDOWS\system32\syscontr.dll 2001-08-23 23:12:28 13,107,200 —-a-w C:\WINDOWS\system32\oembios.bin 2001-08-23 23:11:02 4,490 —-a-w C:\WINDOWS\system32\oembios.dat 2001-08-18 03:36:34 8,192 —-a-w C:\WINDOWS\system32\tsbyuv.dll 2001-08-17 22:00:52 54,272 —-a-w C:\WINDOWS\system32\drivers\swmidi.sys 2001-08-17 21:46:40 6,400 —-a-w C:\WINDOWS\system32\drivers\enum1394.sys 2001-08-17 20:59:44 3,072 —-a-w C:\WINDOWS\system32\drivers\audstub.sys 2001-08-03 17:32:18 159,552 —-a-w C:\WINDOWS\system32\drivers\ntspppoe.sys 2001-07-13 20:09:44 279,552 —-a-w C:\WINDOWS\system32\itiimg3.dll 2001-07-04 01:33:00 53,248 —-a-w C:\WINDOWS\system32\SONYHCY.DLL 2001-06-29 15:52:08 192,512 —-a-w C:\WINDOWS\system32\PretzlDn.dll 2001-06-13 00:49:50 245,760 —-a-w C:\WINDOWS\system32\PretzlUp.dll 2001-05-09 21:47:10 466,944 —-a-w C:\WINDOWS\system32\wmv8dmoe.dll 2001-05-07 22:16:00 483,328 —-a-w C:\WINDOWS\system32\vroom.dll 2001-05-03 19:18:56 176,128 —-a-w C:\WINDOWS\system32\vroomlib.dll 2001-03-27 21:34:22 35,600 —-a-w C:\WINDOWS\system32\drivers\alcan5ln.sys 2001-03-27 06:34:16 5,600 —-a-r C:\WINDOWS\system32\stci.dll 2001-03-27 06:34:08 588,784 —-a-r C:\WINDOWS\system32\drivers\alcaudsl.sys 2001-03-27 06:34:02 4,000 —-a-r C:\WINDOWS\system32\drivers\alcacr.sys 2001-03-27 06:33:54 5,440 —-a-r C:\WINDOWS\system32\drivers\alcawh.sys 2001-03-24 07:22:10 314,880 ——w C:\WINDOWS\system32\LFCMP12n.DLL 2001-03-24 07:21:18 854,528 ——w C:\WINDOWS\system32\Ltwvc12n.dll 2001-03-24 07:19:22 155,648 ——w C:\WINDOWS\system32\LFTIF12n.DLL 2001-03-24 07:18:30 121,856 ——w C:\WINDOWS\system32\lfmpg12n.dll 2001-03-24 07:17:32 43,008 ——w C:\WINDOWS\system32\lfgif12n.dll 2001-03-24 07:15:56 25,600 ——w C:\WINDOWS\system32\lfavi12n.dll 2001-03-24 07:15:48 78,336 ——w C:\WINDOWS\system32\LFFAX12n.DLL 2001-03-24 07:14:12 166,400 ——w C:\WINDOWS\system32\LTIMG12n.DLL 2001-03-24 07:13:36 122,368 ——w C:\WINDOWS\system32\LTFIL12n.DLL 2001-03-24 07:13:20 278,528 ——w C:\WINDOWS\system32\LTDIS12n.DLL 2001-03-24 07:13:14 406,528 ——w C:\WINDOWS\system32\LTKRN12n.DLL 2001-03-21 02:55:00 41,472 ——w C:\WINDOWS\system32\LTTWN12n.DLL 2001-03-21 02:54:40 227,840 ——w C:\WINDOWS\system32\LTEFX12n.DLL 2001-03-10 17:28:52 356,352 —-a-w C:\WINDOWS\eSellerateEngine.dll 2001-03-10 17:28:29 ——– d—–w C:\Program Files\Common Files\DeskShare Shared 2001-03-10 17:28:25 ——– d—–w C:\Program Files\Deskshare 2001-03-10 16:40:15 ——– d—–w C:\Program Files\ContextConvert Pro 2001-03-10 16:37:39 ——– d—–w C:\Program Files\Common Files\MimarSinan 2001-03-03 01:52:42 8,704 —-a-w C:\WINDOWS\system32\npwmsdrm.dll 2001-02-08 15:18:58 69,632 —-a-w C:\WINDOWS\system32\vroomsap.exe 2001-01-22 08:25:24 32,768 —-a-w C:\WINDOWS\system32\ATHPRXY.DLL 2000-12-26 21:15:53 ——– d—–w C:\Program Files\SEGA 2000-12-26 20:29:29 ——– d—–w C:\Program Files\GameSpy Arcade 2000-12-09 03:59:38 122,880 —-a-w C:\WINDOWS\UnGins.exe 2000-11-28 00:51:08 ——– d—–w C:\Program Files\Finale NotePad 2005a 2000-11-09 18:45:43 ——– d—–w C:\Program Files\Common Files\AOL 2000-11-09 18:45:35 ——– d—–w C:\Program Files\AOD 2000-11-07 23:27:40 30,915 —-a-w C:\WINDOWS\nsreg.dat 2000-11-06 15:04:00 633,557 —-a-w C:\WINDOWS\cd32.exe 2000-11-04 18:02:34 1,388 —-a-w C:\DOCUME~1\Owner\APPLIC~1\ViewerApp.dat 2000-10-15 19:37:17 50 —-a-w C:\AUTOEXEC.BAT 2000-10-15 19:36:24 ——– d—–w C:\Program Files\PIXELA 2000-10-15 19:34:48 ——– d—–w C:\Program Files\Sony Corporation 2000-10-15 19:34:22 ——– d—–w C:\Program Files\Common Files\muvee Technologies 2000-10-15 16:27:47 0 –sha-r C:\MSDOS.SYS 2000-10-15 16:27:47 0 –sha-r C:\IO.SYS 2000-10-15 16:27:47 0 —-a-w C:\CONFIG.SYS 2000-10-15 16:27:34 0 -c–a-w C:\WINDOWS\31331333.dat 2000-07-05 16:53:06 88,064 —-a-w C:\WINDOWS\system32\AudioExCtl.dll 2000-06-20 06:32:58 59,392 —-a-w C:\WINDOWS\system32\lfwmf11n.dll 2000-06-20 06:32:58 56,320 —-a-w C:\WINDOWS\system32\lfpsd11n.dll 2000-06-20 06:32:58 27,648 —-a-w C:\WINDOWS\system32\lfwpg11n.dll 2000-06-20 06:32:58 26,112 —-a-w C:\WINDOWS\system32\lfpcd11n.dll 2000-06-20 06:32:58 127,488 —-a-w C:\WINDOWS\system32\ltimg11n.dll 2000-06-20 06:32:56 31,232 —-a-w C:\WINDOWS\system32\lfeps11n.dll 2000-05-24 12:45:58 118,784 —-a-w C:\WINDOWS\system32\MSSTDFMT.DLL 2000-05-12 03:06:20 397,312 —-a-w C:\WINDOWS\system32\MSRDO20.DLL 2000-05-04 02:17:52 272,491 —-a-w C:\WINDOWS\system32\WBDBV32I.DLL 2000-04-04 07:52:54 151,552 —-a-w C:\WINDOWS\system32\RDOCURS.DLL 2000-02-07 08:42:14 61,952 —-a-w C:\WINDOWS\system32\nabapi32.dll 2000-01-31 19:00:00 2,213,376 —-a-w C:\WINDOWS\system32\bfc42d.dll 2000-01-31 19:00:00 17,920 —-a-w C:\WINDOWS\system32\delphimm.dll 2000-01-31 19:00:00 16,896 —-a-w C:\WINDOWS\system32\bcbmm.dll 2000-01-31 19:00:00 1,676,800 —-a-w C:\WINDOWS\system32\bfc42.dll 2000-01-31 19:00:00 1,496,064 —-a-w C:\WINDOWS\system32\cc3250mt.dll 2000-01-31 19:00:00 1,404,416 —-a-w C:\WINDOWS\system32\cc3250.dll 2000-01-19 15:21:36 114,176 —-a-w C:\WINDOWS\system32\SSCE4132.DLL 2000-01-11 22:46:52 528,384 —-a-w C:\WINDOWS\system32\BladeEnc.dll 1999-11-25 08:40:50 40,960 —-a-w C:\WINDOWS\system32\VBAME.DLL 1999-08-09 20:40:56 163,600 —-a-w C:\WINDOWS\system32\wmaudsdk.dll 1999-05-08 02:24:48 480,768 —-a-w C:\WINDOWS\system32\WBDBT32I.DLL 1999-05-03 09:17:49 67,584 —-a-w C:\WINDOWS\system32\HPFpcl11.dll 1999-05-03 09:17:49 343,040 —-a-w C:\WINDOWS\system32\HPFsrl11.dll 1999-05-03 09:17:49 33,280 —-a-w C:\WINDOWS\system32\HPFcbl11.dll 1999-05-03 09:17:49 29,184 —-a-w C:\WINDOWS\system32\HPFrsu11.dll 1999-05-03 09:17:49 23,552 —-a-w C:\WINDOWS\system32\HPFnet11.dll 1999-05-03 09:17:48 921,600 —-a-w C:\WINDOWS\system32\HPFtbx11.exe 1999-05-03 09:17:48 44,544 —-a-w C:\WINDOWS\system32\HPFtst11.dll 1999-05-03 09:17:48 405,504 —-a-w C:\WINDOWS\system32\HPFui11.dll 1999-05-03 09:17:48 266,752 —-a-w C:\WINDOWS\system32\HPFwin11.dll 1999-05-03 09:17:48 1,223,680 —-a-w C:\WINDOWS\system32\HPFtrl11.dll 1999-05-03 09:17:47 69,284 —-a-w C:\WINDOWS\system32\HPFpml11.dll 1999-05-03 09:17:47 57,240 —-a-w C:\WINDOWS\system32\HPFmem11.dll 1999-05-03 09:17:47 38,400 —-a-w C:\WINDOWS\system32\HPFmon11.dll 1999-05-03 09:17:47 290,304 —-a-w C:\WINDOWS\system32\HPFmrl11.dll 1999-05-03 09:17:47 138,428 —-a-w C:\WINDOWS\system32\HPFmlc11.dll 1999-05-03 09:17:47 126,464 —-a-w C:\WINDOWS\system32\HPFcfg11.exe 1999-05-03 09:17:47 125,440 —-a-w C:\WINDOWS\system32\HPFcnt11.dll 1999-05-03 09:17:47 119,808 —-a-w C:\WINDOWS\system32\HPFlnk11.exe 1999-05-03 09:17:47 117,760 —-a-w C:\WINDOWS\system32\HPFrsa11.dll 1999-05-03 09:17:46 849,920 —-a-w C:\WINDOWS\system32\HPFimg11.dll 1999-05-03 09:17:46 76,800 —-a-w C:\WINDOWS\system32\HPF24r11.dll 1999-05-03 09:17:46 72,368 —-a-w C:\WINDOWS\system32\HPFcom11.dll 1999-05-03 09:17:46 7,680 —-a-w C:\WINDOWS\system32\HPFhrl11.dll 1999-05-03 09:17:46 33,384 —-a-w C:\WINDOWS\system32\HPFiop11.dll 1999-05-03 09:17:46 22,528 —-a-w C:\WINDOWS\system32\HPFhid11.exe 1999-05-03 09:17:46 193,536 —-a-w C:\WINDOWS\system32\HPFcps11.dll 1999-05-03 09:17:45 52,800 —-a-w C:\WINDOWS\system32\drivers\HPFecp11.sys 1999-05-03 09:16:21 40,448 —-a-w C:\WINDOWS\system32\hpfinsta.exe 1999-05-03 09:16:21 36,352 —-a-w C:\WINDOWS\hpfsched.exe 1999-05-03 09:16:05 48,292 —-a-w C:\WINDOWS\system32\HPFlpm11.dll 1999-05-03 09:16:00 172,032 —-a-w C:\WINDOWS\system32\hpfinst.dll 1999-03-26 05:00:00 101,888 —-a-w C:\WINDOWS\system32\VB6STKIT.DLL 1999-01-28 09:02:58 48,640 —-a-w C:\WINDOWS\system32\INETWH32.dll 1998-10-29 22:45:06 306,688 —-a-w C:\WINDOWS\IsUninst.exe 1998-10-01 17:00:38 520,128 —-a-w C:\WINDOWS\system32\MAPI.DLL 1998-08-10 01:07:34 94,208 —-a-w C:\WINDOWS\system32\MSSTKPRP.DLL 1998-07-24 12:42:48 101,376 —-a-w C:\WINDOWS\system32\Ptsaab32.dll 1998-07-24 12:42:32 96,768 —-a-w C:\WINDOWS\system32\Ptsacx40.dll 1998-07-24 09:05:08 50,048 —-a-w C:\WINDOWS\system32\PTSAABDB.DLL 1998-07-24 09:04:56 116,640 —-a-w C:\WINDOWS\system32\Ptsaci40.dll 1998-06-18 09:08:32 53,248 —-a-w C:\WINDOWS\system32\MFC42ENU.DLL 1998-06-18 05:00:00 89,360 —-a-w C:\WINDOWS\system32\VB5DB.DLL 1998-05-08 04:57:22 143,872 —-a-w C:\WINDOWS\system32\iacenc.dll 1998-03-26 05:00:00 38,160 —-a-w C:\WINDOWS\system32\MAPISRVR.EXE 1998-03-25 11:54:08 15,872 —-a-w C:\WINDOWS\system32\SCP32.DLL 1998-02-09 16:00:00 29,952 —-a-w C:\WINDOWS\system32\borlndmm.dll 1997-10-01 12:20:40 30,080 —-a-w C:\WINDOWS\system32\Ptabimp3.exe 1997-10-01 12:20:34 21,840 —-a-w C:\WINDOWS\system32\PTSAAB30.DLL 1997-07-15 16:30:52 120,832 —-a-w C:\WINDOWS\system32\ShnDll32.dll 1997-06-14 02:56:08 56,832 —-a-w C:\WINDOWS\system32\iyvu9_32.dll 1997-04-09 02:08:10 299,520 —-a-w C:\WINDOWS\uninst.exe 1996-10-15 14:53:16 78,848 —-a-w C:\WINDOWS\system32\INLOADER.DLL 1995-07-31 19:44:46 212,480 —-a-w C:\WINDOWS\PCDLIB32.DLL 1994-11-22 13:09:58 317,116 —-a-w C:\WINDOWS\system32\WBTR32.EXE 1994-11-22 12:54:18 17,704 —-a-w C:\WINDOWS\system32\WBTRLOCL.DLL 1994-11-22 12:52:40 4,280 —-a-w C:\WINDOWS\system32\WBT32RES.DLL 1994-11-17 08:22:50 16,496 —-a-w C:\WINDOWS\system32\WBTRCALL.DLL 1994-08-10 13:43:12 4,128 —-a-w C:\WINDOWS\system32\WBTRVRES.DLL

coheedKid

Post #8May 27, 2007, 4:12 PM UTC

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4efb-9B51-7695ECA05670}=C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll [09/29/2004 01:02 PM]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [05/31/2005 01:04 AM]
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}=C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll [08/02/2005 01:41 PM]
{AC63E727-A2DF-4CF5-BF96-A4D52BF20A45}=C:\WINDOWS\Config\ofntsvs.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [10/07/2002 09:23 AM]
"KBD"="C:\HP\KBD\KBD.EXE" [02/11/2003 10:02 PM]
"nwiz"="nwiz.exe" [08/19/2003 04:56 AM C:\WINDOWS\system32\nwiz.exe]
"LTMSG"="LTMSG.exe" []
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [11/10/2003 01:30 PM]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [03/27/2001 04:33 PM]
"hpidschd.exe"="" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [12/12/2003 07:50 PM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [01/30/2005 06:05 PM]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [06/03/2004 02:50 AM]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe" [05/10/2005 04:04 PM]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [08/03/2005 01:36 AM]
"VideoraiPodConverter"="C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe" [11/11/2005 01:32 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [09/01/2006 03:57 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [09/12/2006 01:58 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"NVIEW"="nview.dll,nViewLoadHook" []
"AIM"="C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe" [08/01/2006 04:35 PM]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [06/14/2005 10:05 AM]
"Weather"="C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" [09/09/2004 06:35 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
"WeatherWatcher"="C:\Program Files\Weather Watcher\ww.exe" [05/12/2007 10:23 AM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"{dfa61db1-388e-4c87-8d56-540fa229bcb4}"="C:\WINDOWS\System32\dpfwu.dll" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9956773e-6a66-11d8-84c7-806d6172696f}]
AutoRun\command- D:\Info.exe folder.htt 480 480

Contents of the 'Scheduled Tasks' folder
2007-05-06 19:09:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-05-26 01:22:51 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job
2007-05-27 15:53:49 C:\WINDOWS\tasks\Symantec NetDetect.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-27 10:55:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

********************************************************************

Completion time: 05/27/2007 10:56:58 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 05/27/2007 10:56 AM
C:\ComboFix2.txt … 05/26/2007 07:03 PM

— E O F —

and here's the hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:02:17 AM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://aimhome.netscape.com/aimhome.adp
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {AC63E727-A2DF-4CF5-BF96-A4D52BF20A45} - C:\WINDOWS\Config\ofntsvs.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Protection Bar - {44d22a64-2399-4edf-8b32-f2c729c1e8a7} - C:\Program Files\MMediaCodec\iesplugin.dll (file missing)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [hpidschd.exe -log – -log] C:\Program Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [AIM] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Smiley District - {0418F3E3-C763-4e02-9EC5-F0AE13B54B0F} - C:\Program Files\SmileyDistrict\insmile.dll (file missing)
O9 - Extra 'Tools' menuitem: Smiley District - {0418F3E3-C763-4e02-9EC5-F0AE13B54B0F} - C:\Program Files\SmileyDistrict\insmile.dll (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .asx: c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .avi: c:\progra~1\netscape\commun~1\program\PLUGINS\npavi32.dll
O12 - Plugin for .wma: c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153174521812
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?322
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{82018730-5904-4A73-9DF2-FAFB92A08EEF}: NameServer = 68.94.156.1 151.164.8.201
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

coheedKid

Post #9May 27, 2007, 4:13 PM UTC

that was really long this time, but that's what came up. hope it helps.

miekiemoes

Post #10May 27, 2007, 5:22 PM UTC

Hi,

Not sure what happened with combofix here - it looks like it created two logs in once. Also, I see it failed with the registry part of the script..

Anyway, do next please..

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O2 - BHO: (no name) - {AC63E727-A2DF-4CF5-BF96-A4D52BF20A45} - C:\WINDOWS\Config\ofntsvs.dll (file missing)
O3 - Toolbar: Protection Bar - {44d22a64-2399-4edf-8b32-f2c729c1e8a7} - C:\Program Files\MMediaCodec\iesplugin.dll (file missing)
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O9 - Extra button: Smiley District - {0418F3E3-C763-4e02-9EC5-F0AE13B54B0F} - C:\Program Files\SmileyDistrict\insmile.dll (file missing)
O9 - Extra 'Tools' menuitem: Smiley District - {0418F3E3-C763-4e02-9EC5-F0AE13B54B0F} - C:\Program Files\SmileyDistrict\insmile.dll (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\System32\dpfwu.dll (file missing)

* Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6u1.
Scroll down to where it says "Java Runtime Environment (JRE) 6u1".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation, Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Examples of older versions in Add or Remove Programs:
- Java 2 Runtime Environment, SE v1.4.2
- J2SE Runtime Environment 5.0
- J2SE Runtime Environment 5.0 Update 6
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.

Post a new HijackThislog in your next reply.

coheedKid

Post #11May 28, 2007, 4:30 PM UTC

cool. thanks a lot.

hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:29:21 AM, on 5/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://aimhome.netscape.com/aimhome.adp
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [hpidschd.exe -log – -log] C:\Program Files\Hewlett-Packard\HP Instant Delivery\hpidschd.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [VideoraiPodConverter] C:\Program Files\VideoraiPodConverter\VideoraiPodConverter.exe -t
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [AIM] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .asx: c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .avi: c:\progra~1\netscape\commun~1\program\PLUGINS\npavi32.dll
O12 - Plugin for .wma: c:\progra~1\netscape\commun~1\program\PLUGINS\npdsplay.dll
O12 - Plugin for .wmv: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1153174521812
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?322
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{82018730-5904-4A73-9DF2-FAFB92A08EEF}: NameServer = 68.94.156.1 151.164.8.201
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

miekiemoes

Post #12May 28, 2007, 4:55 PM UTC

Hi, Your log looks clean again.

How are things now? Popups etc gone?

coheedKid

Post #13May 29, 2007, 11:41 PM UTC

yeah, no more buffer overrun! thanks so much, man. i really appreciate it. sweet deal.

miekiemoes

Post #14May 29, 2007, 11:47 PM UTC

Glad I could help.

Please read my Prevention page with lots of info and tips how to prevent this in the future.
And if you want to improve speed/system performance after malware removal, take a look here.

Happy Surfing again!

miekiemoes

Post #15June 4, 2007, 11:04 AM UTC

Since this issue appears resolved … this Topic is closed. If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Buffer Overrun Detected In Explorer.exe

✨ Ask AI

Ask AI