[FIXED]Trojan.win32.BHO.een showing up in sigma64.dll
Goto page 1, 2  Next
CastleCops -> Trend Micro HijackThis Logs

---

Author: Isara, Location: USA Posted: Thu Jun 26, 2008 10:09 pm    Post subject: Trojan.win32.BHO.een showing up in sigma64.dll

---

From my original query, which is still valid after all of the instructions in MRP...

Quote:

I did something dumb and caught a trojan last night. After scrubbing with PC-cillin, I ran a secondary online test with Kaspersky, which identified an infection in C:\Windows\System32\sigma64.dll with the threat name Trojan.win32.BHO.een PC-cillin still isn't recognizing this as a threat, and I'm not certain if it's part of the ComboFix program I ran last night to repair the effects of the Trojan. Is this something I need to worry about and, if so, what can I do to remove it?

As suggested, I'm posting the contents of my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:17:21, on 6/26/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\Fingerprint Reader Suite\psqltray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://net.magnes.org/exchweb/bin/auth/owalogon.asp?url=https://net.magnes.org/exchange&reason=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Update Class - {6F282C89-3BD3-4387-92D9-C76428B07E07} - C:\Program Files\Google\Update\1.1.25.0\GoopdateBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.3.24.0\gears.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm
O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.3.24.0\gears.dll
O9 - Extra 'Tools' menuitem: &Google Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.3.24.0\gears.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c8a71d1871cae0) (gupdate1c8a71d1871cae0) - Google Inc. - C:\Program Files\Google\Update\1.1.25.0\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 8902 bytes

---

Author: Prince_Serendip,  Posted: Fri Jun 27, 2008 11:32 am    Post subject:

---

Previous topic is here: /postitle125132-0-0-.html.html

Apparently not fixed.

You're Ready for cleaning.

At CastleCops we screen all HijackThis logs for errors, out-of-date versions, unupdated operating systems, omissions and P2P applications; getting you [READY] for cleaning by our 1st Responders and Security Experts. Now you wait for one of them to come help you.

---

Author: Isara, Location: USA Posted: Wed Jul 09, 2008 4:37 pm    Post subject: New HJT log

---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:28:10 AM, on 7/9/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Fingerprint Reader Suite\psqltray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://net.magnes.org/exchweb/bin/auth/owalogon.asp?url=https://net.magnes.org/exchange&reason=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Update Class - {6F282C89-3BD3-4387-92D9-C76428B07E07} - C:\Program Files\Google\Update\1.1.25.0\GoopdateBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.3.24.0\gears.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm
O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.3.24.0\gears.dll
O9 - Extra 'Tools' menuitem: &Google Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.3.24.0\gears.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c8a71d1871cae0) (gupdate1c8a71d1871cae0) - Google Inc. - C:\Program Files\Google\Update\1.1.25.0\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

---

Author: bamajim,  Posted: Wed Jul 09, 2008 4:56 pm    Post subject:

---

Isara

If you ran Combofix (which is not recommended to do without assistance) post the results of the C:\Combofix.txt log

As a reply to this thread

---

Author: Isara, Location: USA Posted: Wed Jul 09, 2008 5:16 pm    Post subject:

---

It's not allowing me to run ComboFix again, as it claims an incompatible OS. Downloading the program is difficult, as most links to the downloads are either no longer viable, or are somehow being blocked.

I did manage to download a version from 4shared.com, here: http://www.4shared.com/file/54181739/f97baae1/ComboFix.html

but this installation is claiming an incompatible OS (I'm running Vista)

---

Author: bamajim,  Posted: Wed Jul 09, 2008 6:06 pm    Post subject:

---

Isara

Let's do this

1. Go HERE and download File Lister.

Save it to your Desktop
Rt Click ->> Extract all ->> And extract it to your Desktop
Additional help on extracting zip files can be found HERE
Open the File Lister Folder.
Rt Click FileLister.vbe ->>Select Open Then Open to confirm.
As the program runs, it will appear that nothing is happening.
When the program is fnished it will produce a log for you C:\Files.txt

Copy and paste the contents of that log in your reply.

---

Author: Isara, Location: USA Posted: Wed Jul 09, 2008 8:01 pm    Post subject:

---

+++++++++++++++++++++++++++++++++
+
+ File Lister
+
+ Version 1.0.3
+
+ By bamajim@bamajim.com
+
+++++++++++++++++++++++++++++++++

Report ran on --->>> 7/9/2008 1:00:07 PM

=== Values under HKLM\~\Run ======

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\\Program Files\\DellTPad\\Apoint.exe"
"OEM02Mon.exe"="C:\\Windows\\OEM02Mon.exe"
"VolPanel"="\"C:\\Program Files\\Creative\\SBAudigy\\Volume Panel\\VolPanlu.exe\" /r"
"UpdReg"="C:\\Windows\\UpdReg.EXE"
"PSQLLauncher"="\"C:\\Program Files\\Fingerprint Reader Suite\\launcher.exe\" /startup"
"IAAnotif"="\"C:\\Program Files\\Intel\\Intel Matrix Storage Manager\\Iaanotif.exe\""
"Broadcom Wireless Manager UI"="C:\\Windows\\system32\\WLTRAY.exe"
"Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"
"pccguide.exe"="\"C:\\Program Files\\Trend Micro\\Internet Security 14\\pccguide.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe"
"SigmatelSysTrayApp"=hex(2):25,50,72,6f,67,72,61,6d,46,69,6c,65,73,25,5c,53,69,\
67,6d,61,54,65,6c,5c,43,2d,4d,61,6a,6f,72,20,41,75,64,69,6f,5c,57,44,4d,5c,\
73,74,74,72,61,79,2e,65,78,65,00
"NvSvc"="RUNDLL32.EXE C:\\Windows\\system32\\nvsvc.dll,nvsvcStart"
"NvCplDaemon"="RUNDLL32.EXE C:\\Windows\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\Windows\\system32\\NvMcTray.dll,NvTaskbarInit"
"NVHotkey"="rundll32.exe C:\\Windows\\system32\\nvHotkey.dll,Start"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
@=""


=== Values under HKCU\~\Run ======

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater]
@=""


=== Folders and Files from "%\" and "%\Windows" Created Last 30 Days ======

7/9/2008 10:03:45 AM 3600266 C:\ComboFix
6/24/2008 7:10:14 PM 3614348 C:\QooBox
6/24/2008 7:10:54 PM 10795 C:\QooBox\BackEnv
6/24/2008 7:10:46 PM 54 C:\QooBox\Quarantine
6/24/2008 7:10:46 PM 0 C:\QooBox\Quarantine\C
6/24/2008 7:13:56 PM 0 C:\QooBox\Quarantine\C\Windows
6/24/2008 7:13:56 PM 0 C:\QooBox\Quarantine\C\Windows\System32
6/24/2008 7:13:52 PM 0 C:\QooBox\Quarantine\Registry_backups
7/9/2008 10:03:39 AM 5218 32 C:\Bug.txt
6/24/2008 7:48:07 PM 19589 32 C:\ComboFix.txt
7/9/2008 1:00:07 PM 3381 32 C:\Files.txt
6/24/2008 7:10:36 PM 128899221 C:\Windows\erdnt
6/24/2008 7:10:36 PM 64990477 C:\Windows\erdnt\Hiv-backup
6/24/2008 7:10:45 PM 3866624 C:\Windows\erdnt\Hiv-backup\Users
6/24/2008 7:10:45 PM 151552 C:\Windows\erdnt\Hiv-backup\Users\00000001
6/24/2008 7:10:45 PM 151552 C:\Windows\erdnt\Hiv-backup\Users\00000002
6/24/2008 7:10:45 PM 2224128 C:\Windows\erdnt\Hiv-backup\Users\00000003
6/24/2008 7:10:45 PM 1339392 C:\Windows\erdnt\Hiv-backup\Users\00000004
6/24/2008 7:14:20 PM 63908634 C:\Windows\erdnt\subs
6/24/2008 7:13:56 PM 14132 C:\Windows\TEMP
6/24/2008 5:26:45 PM 451072 C:\Windows\WinRAR 3 71
6/21/2008 11:23:54 PM 58880 32 C:\Windows\bfsvc.exe
6/21/2008 11:23:33 PM 2927104 32 C:\Windows\explorer.exe
6/21/2008 11:21:19 PM 13312 32 C:\Windows\fveupdate.exe
6/21/2008 11:22:50 PM 498176 32 C:\Windows\HelpPane.exe
6/21/2008 11:21:28 PM 151040 32 C:\Windows\notepad.exe
6/26/2008 9:58:28 AM 412 32 C:\Windows\PFRO.log
6/21/2008 11:21:42 PM 134656 32 C:\Windows\regedit.exe
6/26/2008 11:09:28 AM 714 32 C:\Windows\setupact.log
6/26/2008 11:09:28 AM 0 32 C:\Windows\setuperr.log
6/25/2008 11:49:41 AM 81920 32 C:\Windows\System32\404Fix.exe
6/21/2008 11:23:11 PM 136192 32 C:\Windows\System32\aaclient.dll
6/21/2008 11:21:55 PM 2515968 32 C:\Windows\System32\accessibilitycpl.dll
6/21/2008 11:21:37 PM 127488 32 C:\Windows\System32\aclui.dll
6/21/2008 11:21:41 PM 167424 32 C:\Windows\System32\ActionQueue.dll
6/21/2008 11:22:16 PM 1405952 32 C:\Windows\System32\ActiveContentWizard.dll
6/21/2008 11:22:22 PM 204800 32 C:\Windows\System32\activeds.dll
6/21/2008 11:22:08 PM 111616 32 C:\Windows\System32\activeds.tlb
6/21/2008 11:22:11 PM 326656 32 C:\Windows\System32\actxprxy.dll
6/21/2008 11:21:25 PM 81408 32 C:\Windows\System32\ACW.exe
6/21/2008 11:21:23 PM 72704 32 C:\Windows\System32\admparse.dll
6/21/2008 11:22:20 PM 185856 32 C:\Windows\System32\adsldp.dll
6/21/2008 11:22:17 PM 198144 32 C:\Windows\System32\adsldpc.dll
6/21/2008 11:21:33 PM 76288 32 C:\Windows\System32\adsmsext.dll
6/21/2008 11:22:44 PM 257024 32 C:\Windows\System32\adsnt.dll
6/21/2008 11:22:05 PM 605696 32 C:\Windows\System32\adtschema.dll
6/21/2008 11:23:45 PM 798720 32 C:\Windows\System32\advapi32.dll
6/21/2008 11:22:46 PM 128000 32 C:\Windows\System32\advpack.dll
6/21/2008 11:21:43 PM 59392 32 C:\Windows\System32\alg.exe
6/21/2008 11:21:24 PM 70144 32 C:\Windows\System32\amstream.dll
6/21/2008 11:21:20 PM 24064 32 C:\Windows\System32\amxread.dll
6/21/2008 11:23:12 PM 1730560 32 C:\Windows\System32\apds.dll
6/21/2008 11:21:20 PM 13824 32 C:\Windows\System32\apilogen.dll
6/21/2008 11:21:41 PM 219648 32 C:\Windows\System32\apircl.dll
6/21/2008 11:22:51 PM 171008 32 C:\Windows\System32\apphelp.dll
6/21/2008 11:21:19 PM 28160 32 C:\Windows\System32\Apphlpdm.dll
6/21/2008 11:21:35 PM 33280 32 C:\Windows\System32\appinfo.dll
6/21/2008 11:22:47 PM 1122304 32 C:\Windows\System32\appwiz.cpl
6/21/2008 11:21:30 PM 198656 32 C:\Windows\System32\apss.dll
6/21/2008 11:21:21 PM 24576 32 C:\Windows\System32\at.exe
6/21/2008 11:21:21 PM 28160 32 C:\Windows\System32\AtBroker.exe
6/21/2008 11:21:35 PM 71680 32 C:\Windows\System32\atl.dll
6/21/2008 11:21:19 PM 289792 32 C:\Windows\System32\atmfd.dll
6/21/2008 11:21:36 PM 244224 32 C:\Windows\System32\audiodev.dll
6/21/2008 11:22:09 PM 88064 32 C:\Windows\System32\audiodg.exe
6/21/2008 11:23:15 PM 397312 32 C:\Windows\System32\AudioEng.dll
6/21/2008 11:23:11 PM 274944 32 C:\Windows\System32\AUDIOKSE.dll
6/21/2008 11:22:21 PM 116224 32 C:\Windows\System32\AudioSes.dll
6/21/2008 11:23:20 PM 314368 32 C:\Windows\System32\audiosrv.dll
6/21/2008 11:21:33 PM 41472 32 C:\Windows\System32\auditpol.exe
6/21/2008 11:21:24 PM 1370624 32 C:\Windows\System32\Aurora.scr
6/21/2008 11:23:29 PM 251904 32 C:\Windows\System32\authfwcfg.dll
6/21/2008 11:21:21 PM 509952 32 C:\Windows\System32\AuthFWGP.dll
6/21/2008 11:22:55 PM 4595712 32 C:\Windows\System32\AuthFWSnapin.dll
6/21/2008 11:23:29 PM 1985024 32 C:\Windows\System32\authui.dll
6/21/2008 11:22:02 PM 79360 32 C:\Windows\System32\authz.dll
6/21/2008 11:23:30 PM 642560 32 C:\Windows\System32\autochk.exe
6/21/2008 11:23:30 PM 656384 32 C:\Windows\System32\autoconv.exe
6/21/2008 11:23:30 PM 634880 32 C:\Windows\System32\autofmt.exe
6/21/2008 11:21:44 PM 516608 32 C:\Windows\System32\autoplay.dll
6/21/2008 11:21:34 PM 103936 32 C:\Windows\System32\AuxiliaryDisplayApi.dll
6/21/2008 11:22:51 PM 1186304 32 C:\Windows\System32\AuxiliaryDisplayCpl.dll
6/21/2008 11:23:31 PM 174080 32 C:\Windows\System32\AuxiliaryDisplayDriverLib.dll
6/21/2008 11:22:14 PM 102912 32 C:\Windows\System32\AuxiliaryDisplayServices.dll
6/21/2008 11:22:53 PM 91136 32 C:\Windows\System32\avifil32.dll
6/21/2008 11:21:20 PM 12800 32 C:\Windows\System32\avrt.dll
6/21/2008 11:23:17 PM 756736 32 C:\Windows\System32\azroles.dll
6/21/2008 11:22:50 PM 317440 32 C:\Windows\System32\azroleui.dll
6/21/2008 11:22:04 PM 28160 32 C:\Windows\System32\AzSqlExt.dll
6/21/2008 11:23:15 PM 131640 32 C:\Windows\System32\basecsp.dll
6/21/2008 11:21:51 PM 68096 32 C:\Windows\System32\basesrv.dll
6/21/2008 11:21:32 PM 12800 32 C:\Windows\System32\batt.dll
6/21/2008 11:23:15 PM 334336 32 C:\Windows\System32\bcdedit.exe
6/21/2008 11:21:41 PM 48128 32 C:\Windows\System32\bcdprov.dll
6/21/2008 11:23:10 PM 117760 32 C:\Windows\System32\bcdsrv.dll
6/21/2008 11:23:32 PM 274432 32 C:\Windows\System32\bcrypt.dll
6/21/2008 11:23:20 PM 328704 32 C:\Windows\System32\BFE.DLL
6/21/2008 11:21:34 PM 192000 32 C:\Windows\System32\bitsadmin.exe
6/21/2008 11:21:21 PM 31744 32 C:\Windows\System32\bitsigd.dll
6/21/2008 11:23:57 PM 542720 32 C:\Windows\System32\blackbox.dll
6/21/2008 11:21:23 PM 81408 32 C:\Windows\System32\bootcfg.exe
6/21/2008 11:21:11 PM 2560 32 C:\Windows\System32\bootstr.dll
6/21/2008 11:22:09 PM 24120 32 C:\Windows\System32\BOOTVID.DLL
6/21/2008 11:22:48 PM 1342464 32 C:\Windows\System32\brcpl.dll
6/21/2008 11:21:36 PM 52736 32 C:\Windows\System32\brcplsdw.dll
6/21/2008 11:21:24 PM 15360 32 C:\Windows\System32\bridgeunattend.exe
6/21/2008 11:21:34 PM 81920 32 C:\Windows\System32\browser.dll
6/21/2008 11:23:28 PM 1324032 32 C:\Windows\System32\browseui.dll
6/21/2008 11:21:52 PM 45568 32 C:\Windows\System32\bthci.dll
6/21/2008 11:21:33 PM 990208 32 C:\Windows\System32\bthprops.cpl
6/21/2008 11:21:41 PM 91648 32 C:\Windows\System32\btpanui.dll
6/21/2008 11:21:24 PM 879616 32 C:\Windows\System32\Bubbles.scr
6/21/2008 11:21:54 PM 71680 32 C:\Windows\System32\cabinet.dll
6/21/2008 11:21:53 PM 97280 32 C:\Windows\System32\cabview.dll
6/21/2008 11:21:23 PM 25600 32 C:\Windows\System32\cacls.exe
6/21/2008 11:21:27 PM 17920 32 C:\Windows\System32\capisp.dll
6/21/2008 11:22:22 PM 451072 32 C:\Windows\System32\catsrv.dll
6/21/2008 11:22:42 PM 487936 32 C:\Windows\System32\catsrvut.dll
6/21/2008 11:22:55 PM 44032 32 C:\Windows\System32\cbsra.exe
6/21/2008 11:21:19 PM 36864 32 C:\Windows\System32\cdd.dll
6/21/2008 11:23:13 PM 805888 32 C:\Windows\System32\cdosys.dll
6/21/2008 11:23:11 PM 323072 32 C:\Windows\System32\certcli.dll
6/21/2008 11:23:44 PM 1111552 32 C:\Windows\System32\CertEnroll.dll
6/21/2008 11:21:19 PM 6656 32 C:\Windows\System32\CertEnrollCtrl.exe
6/21/2008 11:22:11 PM 632832 32 C:\Windows\System32\CertEnrollUI.dll
6/21/2008 11:23:10 PM 1502720 32 C:\Windows\System32\certmgr.dll
6/21/2008 11:21:34 PM 40448 32 C:\Windows\System32\certprop.dll
6/21/2008 11:22:44 PM 215040 32 C:\Windows\System32\certreq.exe
6/21/2008 11:23:33 PM 798720 32 C:\Windows\System32\certutil.exe
6/21/2008 11:21:34 PM 225792 32 C:\Windows\System32\cewmdm.dll
7/9/2008 10:03:45 AM 318976 32 C:\Windows\System32\CF1185.exe
6/21/2008 11:21:24 PM 47104 32 C:\Windows\System32\cfgbkend.dll
6/21/2008 11:21:15 PM 17408 32 C:\Windows\System32\cfgmgr32.dll
6/21/2008 11:23:13 PM 124928 32 C:\Windows\System32\chajei.ime
6/21/2008 11:21:53 PM 1671168 32 C:\Windows\System32\chsbrkr.dll
6/21/2008 11:21:17 PM 6103040 32 C:\Windows\System32\chtbrkr.dll
6/21/2008 11:22:04 PM 171520 32 C:\Windows\System32\cic.dll
6/21/2008 11:23:13 PM 124928 32 C:\Windows\System32\cintlgnt.ime
6/21/2008 11:22:57 PM 58368 32 C:\Windows\System32\cipher.exe
6/21/2008 11:22:19 PM 523776 32 C:\Windows\System32\clbcatq.dll
6/21/2008 11:23:34 PM 247352 32 C:\Windows\System32\clfs.sys
6/21/2008 11:21:59 PM 56832 32 C:\Windows\System32\clfsw32.dll
6/21/2008 11:23:40 PM 178176 32 C:\Windows\System32\clusapi.dll
6/21/2008 11:21:23 PM 31232 32 C:\Windows\System32\cmcfg32.dll
6/21/2008 11:22:55 PM 318976 32 C:\Windows\System32\cmd.exe
6/21/2008 11:22:00 PM 481792 32 C:\Windows\System32\cmdial32.dll
6/21/2008 11:21:43 PM 72704 32 C:\Windows\System32\cmdl32.exe
6/21/2008 11:23:34 PM 64512 32 C:\Windows\System32\cmicryptinstall.dll
6/21/2008 11:22:58 PM 67584 32 C:\Windows\System32\cmifw.dll
6/21/2008 11:23:34 PM 297472 32 C:\Windows\System32\cmipnpinstall.dll
6/21/2008 11:21:26 PM 32768 32 C:\Windows\System32\cmlua.dll
6/21/2008 11:21:26 PM 48640 32 C:\Windows\System32\cmmon32.exe
6/21/2008 11:21:21 PM 26112 32 C:\Windows\System32\cmpbk32.dll
6/21/2008 11:21:35 PM 84992 32 C:\Windows\System32\cmstp.exe
6/21/2008 11:21:20 PM 14336 32 C:\Windows\System32\cmstplua.dll
6/21/2008 11:21:25 PM 47616 32 C:\Windows\System32\cmutil.dll
6/21/2008 11:21:16 PM 26624 32 C:\Windows\System32\cofiredm.dll
6/21/2008 11:21:24 PM 62464 32 C:\Windows\System32\colbact.dll
6/21/2008 11:21:22 PM 161280 32 C:\Windows\System32\COLORCNV.DLL
6/21/2008 11:21:28 PM 686592 32 C:\Windows\System32\colorui.dll
6/21/2008 11:23:37 PM 531968 32 C:\Windows\System32\comctl32.dll
6/21/2008 11:23:28 PM 450048 32 C:\Windows\System32\comdlg32.dll
6/21/2008 11:22:16 PM 282624 32 C:\Windows\System32\CompatUI.dll
6/21/2008 11:23:49 PM 145408 32 C:\Windows\System32\CompMgmtLauncher.exe
6/21/2008 11:21:26 PM 276480 32 C:\Windows\System32\compstui.dll
6/21/2008 11:21:18 PM 36352 32 C:\Windows\System32\ComputerDefaults.exe
6/21/2008 11:21:25 PM 91648 32 C:\Windows\System32\comrepl.dll
6/21/2008 11:22:54 PM 1291264 32 C:\Windows\System32\comres.dll
6/21/2008 11:23:03 PM 220160 32 C:\Windows\System32\comsnap.dll
6/21/2008 11:23:34 PM 1208320 32 C:\Windows\System32\comsvcs.dll
6/21/2008 11:23:28 PM 593408 32 C:\Windows\System32\comuid.dll
6/21/2008 11:21:44 PM 69120 32 C:\Windows\System32\conime.exe
6/21/2008 11:21:37 PM 1645568 32 C:\Windows\System32\connect.dll
6/21/2008 11:21:45 PM 81920 32 C:\Windows\System32\consent.exe
6/21/2008 11:21:21 PM 17408 32 C:\Windows\System32\convert.exe
6/21/2008 11:21:16 PM 17408 32 C:\Windows\System32\corpol.dll
6/21/2008 11:21:18 PM 15872 32 C:\Windows\System32\credssp.dll
6/21/2008 11:21:25 PM 178176 32 C:\Windows\System32\credui.dll
6/21/2008 11:23:33 PM 977408 32 C:\Windows\System32\crypt32.dll
6/21/2008 11:21:28 PM 57856 32 C:\Windows\System32\cryptdll.dll
6/21/2008 11:23:03 PM 97792 32 C:\Windows\System32\cryptnet.dll
6/21/2008 11:22:23 PM 128000 32 C:\Windows\System32\cryptsvc.dll
6/21/2008 11:22:41 PM 970240 32 C:\Windows\System32\cryptui.dll
6/21/2008 11:22:03 PM 31744 32 C:\Windows\System32\cscapi.dll
6/21/2008 11:21:21 PM 22016 32 C:\Windows\System32\cscdll.dll
6/21/2008 11:23:08 PM 139264 32 C:\Windows\System32\cscript.exe
6/21/2008 11:21:30 PM 49152 32 C:\Windows\System32\csrsrv.dll
6/21/2008 11:21:19 PM 6144 32 C:\Windows\System32\csrss.exe
6/21/2008 11:21:21 PM 46080 32 C:\Windows\System32\csrstub.exe
6/21/2008 11:21:41 PM 1029120 32 C:\Windows\System32\d3d10.dll
6/21/2008 11:21:45 PM 188416 32 C:\Windows\System32\d3d10core.dll
6/21/2008 11:23:29 PM 159744 32 C:\Windows\System32\d3d10_1.dll
6/21/2008 11:23:28 PM 208896 32 C:\Windows\System32\d3d10_1core.dll
6/21/2008 11:22:00 PM 1039360 32 C:\Windows\System32\d3d8.dll
6/21/2008 11:23:40 PM 1788928 32 C:\Windows\System32\d3d9.dll
6/21/2008 11:21:26 PM 384512 32 C:\Windows\System32\d3dim.dll
6/21/2008 11:21:28 PM 816128 32 C:\Windows\System32\d3dim700.dll
6/21/2008 11:21:19 PM 53248 32 C:\Windows\System32\d3dxof.dll
6/21/2008 11:23:14 PM 1855488 32 C:\Windows\System32\dbgeng.dll
6/21/2008 11:23:18 PM 798208 32 C:\Windows\System32\dbghelp.dll
6/21/2008 11:21:42 PM 135168 32 C:\Windows\System32\dbnetlib.dll
6/21/2008 11:23:19 PM 522752 32 C:\Windows\System32\ddraw.dll
6/21/2008 11:22:17 PM 226816 32 C:\Windows\System32\Defrag.exe
6/21/2008 11:21:24 PM 368640 32 C:\Windows\System32\desk.cpl
6/21/2008 11:21:20 PM 64000 32 C:\Windows\System32\devenum.dll
6/21/2008 11:22:13 PM 377344 32 C:\Windows\System32\devmgr.dll
6/21/2008 11:21:52 PM 39936 32 C:\Windows\System32\dfdts.dll
6/21/2008 11:22:15 PM 68608 32 C:\Windows\System32\DFDWiz.exe
6/21/2008 11:22:22 PM 96768 32 C:\Windows\System32\dfrgfat.exe
6/21/2008 11:21:42 PM 58880 32 C:\Windows\System32\dfrgifc.exe
6/21/2008 11:23:26 PM 163840 32 C:\Windows\System32\DfrgNtfs.exe
6/21/2008 11:23:21 PM 671232 32 C:\Windows\System32\dfrgui.exe
6/21/2008 11:23:12 PM 96760 32 C:\Windows\System32\dfshim.dll
6/21/2008 11:24:10 PM 2091520 32 C:\Windows\System32\dfsr.exe
6/21/2008 11:23:41 PM 53760 32 C:\Windows\System32\DfsShlEx.dll
6/21/2008 11:22:51 PM 204288 32 C:\Windows\System32\dhcpcsvc.dll
6/21/2008 11:23:19 PM 128000 32 C:\Windows\System32\dhcpcsvc6.dll
6/21/2008 11:21:50 PM 66048 32 C:\Windows\System32\DHCPQEC.DLL
6/21/2008 11:22:22 PM 61440 32 C:\Windows\System32\dhcpsapi.dll
6/21/2008 11:23:39 PM 1078272 32 C:\Windows\System32\diagperf.dll
6/21/2008 11:21:25 PM 94208 32 C:\Windows\System32\diantz.exe
6/21/2008 11:21:26 PM 35328 32 C:\Windows\System32\dimsjob.dll
6/21/2008 11:22:11 PM 54784 32 C:\Windows\System32\dimsroam.dll
6/21/2008 11:21:25 PM 159232 32 C:\Windows\System32\dinput8.dll
6/21/2008 11:22:54 PM 120320 32 C:\Windows\System32\diskpart.exe
6/21/2008 11:21:56 PM 230912 32 C:\Windows\System32\diskraid.exe
6/21/2008 11:21:25 PM 35328 32 C:\Windows\System32\dispci.dll
6/21/2008 11:21:50 PM 121856 32 C:\Windows\System32\dispdiag.exe
6/21/2008 11:21:14 PM 32768 32 C:\Windows\System32\dispex.dll
6/21/2008 11:22:22 PM 388096 32 C:\Windows\System32\dmdlgs.dll
6/21/2008 11:22:56 PM 184320 32 C:\Windows\System32\dmdskmgr.dll
6/21/2008 11:21:10 PM 2048 32 C:\Windows\System32\dmdskres2.dll
6/21/2008 11:21:21 PM 178688 32 C:\Windows\System32\dmime.dll
6/21/2008 11:21:18 PM 38400 32 C:\Windows\System32\dmloader.dll
6/21/2008 11:21:40 PM 42496 32 C:\Windows\System32\dmocx.dll
6/21/2008 11:21:19 PM 84480 32 C:\Windows\System32\dmscript.dll
6/21/2008 11:21:22 PM 105472 32 C:\Windows\System32\dmsynth.dll
6/21/2008 11:21:33 PM 101888 32 C:\Windows\System32\dmusic.dll
6/21/2008 11:21:17 PM 18944 32 C:\Windows\System32\dmutil.dll
6/21/2008 11:23:28 PM 131584 32 C:\Windows\System32\dmvdsitf.dll
6/21/2008 11:22:00 PM 88064 32 C:\Windows\System32\dmview.ocx
6/21/2008 11:23:10 PM 165888 32 C:\Windows\System32\dnsapi.dll
6/21/2008 11:21:37 PM 25088 32 C:\Windows\System32\dnscacheugc.exe
6/21/2008 11:21:27 PM 48128 32 C:\Windows\System32\dnshc.dll
6/21/2008 11:22:52 PM 86528 32 C:\Windows\System32\dnsrslvr.dll
6/21/2008 11:22:22 PM 289467 32 C:\Windows\System32\dot3.tmf
6/21/2008 11:22:56 PM 45056 32 C:\Windows\System32\dot3api.dll
6/21/2008 11:22:21 PM 49664 32 C:\Windows\System32\dot3cfg.dll
6/21/2008 11:21:20 PM 45568 32 C:\Windows\System32\dot3dlg.dll
6/21/2008 11:21:31 PM 43008 32 C:\Windows\System32\dot3gpclnt.dll
6/21/2008 11:23:04 PM 235520 32 C:\Windows\System32\dot3gpui.dll
6/21/2008 11:22:21 PM 74752 32 C:\Windows\System32\dot3msm.dll
6/21/2008 11:23:24 PM 175104 32 C:\Windows\System32\dot3svc.dll
6/21/2008 11:21:42 PM 142848 32 C:\Windows\System32\dot3ui.dll
6/21/2008 11:21:43 PM 407040 32 C:\Windows\System32\dpapimig.exe
6/21/2008 11:21:22 PM 160768 32 C:\Windows\System32\DpiScaling.exe
6/21/2008 11:21:23 PM 376320 32 C:\Windows\System32\dpnet.dll
6/21/2008 11:22:41 PM 134656 32 C:\Windows\System32\dps.dll
6/21/2008 11:20:09 PM 258560 32 C:\Windows\System32\dpx.dll
6/21/2008 11:21:28 PM 66048 32 C:\Windows\System32\driverquery.exe
6/21/2008 11:21:44 PM 284672 32 C:\Windows\System32\drmmgrtn.dll
6/21/2008 11:24:01 PM 978432 32 C:\Windows\System32\drmv2clt.dll
6/21/2008 11:21:50 PM 101888 32 C:\Windows\System32\drvinst.exe
6/21/2008 11:20:10 PM 246784 32 C:\Windows\System32\drvstore.dll
6/21/2008 11:21:26 PM 29696 32 C:\Windows\System32\dsauth.dll
6/21/2008 11:21:20 PM 173568 32 C:\Windows\System32\dsdmo.dll
6/21/2008 11:21:21 PM 86528 32 C:\Windows\System32\dskquota.dll
6/21/2008 11:21:34 PM 190976 32 C:\Windows\System32\dskquoui.dll
6/21/2008 11:22:53 PM 444416 32 C:\Windows\System32\dsound.dll
6/21/2008 11:22:18 PM 137728 32 C:\Windows\System32\dsprop.dll
6/21/2008 11:21:48 PM 394240 32 C:\Windows\System32\dsquery.dll
6/21/2008 11:21:42 PM 44032 32 C:\Windows\System32\dssec.dll
6/21/2008 11:22:45 PM 155704 32 C:\Windows\System32\dssenh.dll
6/21/2008 11:21:33 PM 616448 32 C:\Windows\System32\dsuiext.dll
6/25/2008 11:49:41 AM 51200 32 C:\Windows\System32\dumphive.exe
6/21/2008 11:22:05 PM 183808 32 C:\Windows\System32\duser.dll
6/21/2008 11:22:51 PM 81920 32 C:\Windows\System32\dwm.exe
6/21/2008 11:21:41 PM 39936 32 C:\Windows\System32\dwmapi.dll
6/21/2008 11:22:51 PM 81920 32 C:\Windows\System32\dwmredir.dll
6/21/2008 11:21:43 PM 104448 32 C:\Windows\System32\DWWIN.EXE
6/21/2008 11:22:15 PM 252928 32 C:\Windows\System32\dxdiag.exe
6/21/2008 11:21:54 PM 195072 32 C:\Windows\System32\dxdiagn.dll
6/21/2008 11:23:05 PM 171520 32 C:\Windows\System32\dxgi.dll
6/21/2008 11:21:12 PM 4096 32 C:\Windows\System32\dxmasf.dll
6/21/2008 11:21:59 PM 347136 32 C:\Windows\System32\dxtmsft.dll
6/21/2008 11:21:31 PM 214528 32 C:\Windows\System32\dxtrans.dll
6/21/2008 11:21:41 PM 64512 32 C:\Windows\System32\dxva2.dll
6/21/2008 11:23:56 PM 206830 32 C:\Windows\System32\eaphost.tmf
6/21/2008 11:23:30 PM 187904 32 C:\Windows\System32\eapp3hst.dll
6/21/2008 11:23:27 PM 135680 32 C:\Windows\System32\eappcfg.dll
6/21/2008 11:21:52 PM 93696 32 C:\Windows\System32\eappgnui.dll
6/21/2008 11:23:28 PM 181760 32 C:\Windows\System32\eapphost.dll
6/21/2008 11:21:43 PM 41472 32 C:\Windows\System32\eappprxy.dll
6/21/2008 11:21:40 PM 67584 32 C:\Windows\System32\EAPQEC.DLL
6/21/2008 11:23:11 PM 57344 32 C:\Windows\System32\eapsvc.dll
6/21/2008 11:21:47 PM 86528 32 C:\Windows\System32\efsadu.dll
6/21/2008 11:22:19 PM 179200 32 C:\Windows\System32\els.dll
6/21/2008 11:23:16 PM 564736 32 C:\Windows\System32\emdmgmt.dll
6/21/2008 11:22:46 PM 428544 32 C:\Windows\System32\EncDec.dll
6/21/2008 11:21:24 PM 169984 32 C:\Windows\System32\EncDump.dll
6/21/2008 11:23:12 PM 262144 32 C:\Windows\System32\es.dll
6/21/2008 11:23:35 PM 1452544 32 C:\Windows\System32\esent.dll
6/21/2008 11:21:15 PM 36352 32 C:\Windows\System32\esentprf.dll
6/21/2008 11:21:23 PM 93184 32 C:\Windows\System32\esentutl.exe
6/21/2008 11:21:30 PM 51712 32 C:\Windows\System32\esrb.rs
6/21/2008 11:21:19 PM 19968 32 C:\Windows\System32\eventcls.dll
6/21/2008 11:23:21 PM 485888 32 C:\Windows\System32\evr.dll
6/21/2008 11:21:24 PM 52736 32 C:\Windows\System32\expand.exe
6/21/2008 11:21:24 PM 20992 32 C:\Windows\System32\ExplorerFrame.dll
6/21/2008 11:21:55 PM 133120 32 C:\Windows\System32\extmgr.dll
6/21/2008 11:21:20 PM 53248 32 C:\Windows\System32\extrac32.exe
6/21/2008 11:21:10 PM 7168 32 C:\Windows\System32\f3ahvoas.dll
6/21/2008 11:22:46 PM 147456 32 C:\Windows\System32\Faultrep.dll
6/21/2008 11:22:16 PM 131072 32 C:\Windows\System32\fde.dll
6/21/2008 11:21:25 PM 53760 32 C:\Windows\System32\fdeploy.dll
6/21/2008 11:21:26 PM 13312 32 C:\Windows\System32\fdPHost.dll
6/21/2008 11:22:18 PM 68096 32 C:\Windows\System32\fdSSDP.dll
6/21/2008 11:22:21 PM 69120 32 C:\Windows\System32\fdWCN.dll
6/21/2008 11:22:46 PM 67072 32 C:\Windows\System32\fdWSD.dll
6/21/2008 11:21:41 PM 54272 32 C:\Windows\System32\feclient.dll
6/21/2008 11:22:52 PM 442368 32 C:\Windows\System32\filemgmt.dll
6/21/2008 11:21:27 PM 64512 32 C:\Windows\System32\findnetprinters.dll
6/21/2008 11:21:43 PM 61952 32 C:\Windows\System32\findstr.exe
6/21/2008 11:21:45 PM 2249216 32 C:\Windows\System32\Firewall.cpl
6/21/2008 11:23:32 PM 403968 32 C:\Windows\System32\FirewallAPI.dll
6/21/2008 11:22:21 PM 2585088 32 C:\Windows\System32\FirewallControlPanel.exe
6/21/2008 11:21:28 PM 23040 32 C:\Windows\System32\fmifs.dll
6/21/2008 11:22:54 PM 142336 32 C:\Windows\System32\fontext.dll
6/21/2008 11:21:54 PM 72704 32 C:\Windows\System32\fontsub.dll
6/21/2008 11:21:21 PM 50688 32 C:\Windows\System32\fphc.dll
6/21/2008 11:21:12 PM 11776 32 C:\Windows\System32\framebuf.dll
6/21/2008 11:22:45 PM 202240 32 C:\Windows\System32\framedyn.dll
6/21/2008 11:22:46 PM 204800 32 C:\Windows\System32\framedynos.dll
6/21/2008 11:21:09 PM 144909 32 C:\Windows\System32\fsmgmt.msc
6/10/2008 3:27:31 PM 181760 32 C:\Windows\System32\fsquirt.exe
6/21/2008 11:21:27 PM 55296 32 C:\Windows\System32\fsutil.exe
6/21/2008 11:21:28 PM 41984 32 C:\Windows\System32\ftp.exe
6/21/2008 11:22:42 PM 146944 32 C:\Windows\System32\fundisc.dll
6/21/2008 11:21:24 PM 54272 32 C:\Windows\System32\fwcfg.dll
6/21/2008 11:23:35 PM 595456 32 C:\Windows\System32\FWPUCLNT.DLL
6/21/2008 11:21:28 PM 28672 32 C:\Windows\System32\FwRemoteSvr.dll
6/21/2008 11:21:17 PM 45568 32 C:\Windows\System32\g711codc.ax
6/21/2008 11:23:34 PM 50176 32 C:\Windows\System32\gacinstall.dll
6/10/2008 3:35:31 PM 1695744 32 C:\Windows\System32\gameux.dll
6/10/2008 3:35:31 PM 4240384 32 C:\Windows\System32\GameUXLegacyGDFs.dll
6/21/2008 11:21:10 PM 12198 32 C:\Windows\System32\gatherWiredInfo.vbs
6/21/2008 11:21:10 PM 15181 32 C:\Windows\System32\gatherWirelessInfo.vbs
6/21/2008 11:21:26 PM 65024 32 C:\Windows\System32\getmac.exe
6/21/2008 11:22:14 PM 75264 32 C:\Windows\System32\gpapi.dll
6/21/2008 11:22:48 PM 936960 32 C:\Windows\System32\gpedit.dll
6/21/2008 11:22:50 PM 128000 32 C:\Windows\System32\gpresult.exe
6/21/2008 11:23:36 PM 574464 32 C:\Windows\System32\gpsvc.dll
6/21/2008 11:21:20 PM 16896 32 C:\Windows\System32\gpupdate.exe
6/21/2008 11:21:20 PM 56320 32 C:\Windows\System32\graftabl.com
6/21/2008 11:22:52 PM 16896 32 C:\Windows\System32\grb.rs
6/21/2008 11:21:21 PM 69120 32 C:\Windows\System32\GuidedHelp.dll
6/21/2008 11:21:16 PM 40960 32 C:\Windows\System32\hbaapi.dll
6/21/2008 11:23:14 PM 15872 32 C:\Windows\System32\hcrstco.dll
6/21/2008 11:21:30 PM 67072 32 C:\Windows\System32\HelpPaneProxy.dll
6/21/2008 11:22:18 PM 523776 32 C:\Windows\System32\hhctrl.ocx
6/21/2008 11:21:24 PM 83968 32 C:\Windows\System32\hlink.dll
6/21/2008 11:22:53 PM 289792 32 C:\Windows\System32\hnetcfg.dll
6/21/2008 11:21:16 PM 14848 32 C:\Windows\System32\hnetmon.dll
6/21/2008 11:21:18 PM 21504 32 C:\Windows\System32\HotStartUserAgent.dll
6/21/2008 11:23:30 PM 389632 32 C:\Windows\System32\html.iec
6/21/2008 11:21:34 PM 30720 32 C:\Windows\System32\httpapi.dll
6/21/2008 11:21:36 PM 18944 32 C:\Windows\System32\ias.dll
6/21/2008 11:22:22 PM 56832 32 C:\Windows\System32\iasacct.dll
6/21/2008 11:22:03 PM 54784 32 C:\Windows\System32\iasads.dll
6/21/2008 11:22:19 PM 44032 32 C:\Windows\System32\iasdatastore.dll
6/21/2008 11:22:48 PM 69120 32 C:\Windows\System32\iashlpr.dll
6/21/2008 11:22:50 PM 17408 32 C:\Windows\System32\iashost.exe
6/21/2008 11:23:41 PM 445952 32 C:\Windows\System32\IasMigPlugin.dll
6/21/2008 11:23:18 PM 147968 32 C:\Windows\System32\iasnap.dll
6/21/2008 11:21:54 PM 31744 32 C:\Windows\System32\iaspolcy.dll
6/21/2008 11:23:11 PM 156672 32 C:\Windows\System32\iasrad.dll
6/21/2008 11:22:18 PM 98304 32 C:\Windows\System32\iasrecst.dll
6/21/2008 11:23:26 PM 180224 32 C:\Windows\System32\iassam.dll
6/21/2008 11:22:57 PM 251392 32 C:\Windows\System32\iassdo.dll
6/21/2008 11:22:50 PM 74752 32 C:\Windows\System32\iassvcs.dll
6/21/2008 11:21:17 PM 15872 32 C:\Windows\System32\icaapi.dll
6/21/2008 11:21:45 PM 27136 32 C:\Windows\System32\icacls.exe
6/21/2008 11:24:00 PM 579584 32 C:\Windows\System32\icardagt.exe
6/21/2008 11:21:57 PM 63488 32 C:\Windows\System32\icardie.dll
6/21/2008 11:24:00 PM 11776 32 C:\Windows\System32\icardres.dll
6/21/2008 11:21:56 PM 87552 32 C:\Windows\System32\icfupgd.dll
6/21/2008 11:23:17 PM 215040 32 C:\Windows\System32\icm32.dll
6/21/2008 11:21:35 PM 142336 32 C:\Windows\System32\icsfiltr.dll
6/21/2008 11:21:18 PM 13824 32 C:\Windows\System32\icsunattend.exe
6/21/2008 11:21:12 PM 26112 32 C:\Windows\System32\idndl.dll
6/21/2008 11:22:42 PM 70656 32 C:\Windows\System32\ie4uinit.exe
6/21/2008 11:21:34 PM 153088 32 C:\Windows\System32\ieakeng.dll
6/21/2008 11:21:51 PM 230400 32 C:\Windows\System32\ieaksie.dll
6/21/2008 11:22:45 PM 383488 32 C:\Windows\System32\ieapfltr.dll
6/25/2008 11:49:41 AM 82432 32 C:\Windows\System32\IEDFix.C.exe
6/25/2008 11:49:41 AM 82944 32 C:\Windows\System32\IEDFix.exe
6/21/2008 11:22:45 PM 388096 32 C:\Windows\System32\iedkcs32.dll
6/21/2008 11:21:16 PM 78336 32 C:\Windows\System32\ieencode.dll
6/21/2008 11:24:05 PM 6068736 32 C:\Windows\System32\ieframe.dll
6/21/2008 11:21:52 PM 193024 32 C:\Windows\System32\iepeers.dll
6/21/2008 11:21:24 PM 44544 32 C:\Windows\System32\iernonce.dll
6/21/2008 11:22:47 PM 270336 32 C:\Windows\System32\iertutil.dll
6/21/2008 11:24:05 PM 69120 32 C:\Windows\System32\iesetup.dll
6/21/2008 11:21:56 PM 180736 32 C:\Windows\System32\ieui.dll
6/21/2008 11:21:41 PM 167936 32 C:\Windows\System32\iexpress.exe
6/21/2008 11:22:20 PM 29696 32 C:\Windows\System32\ifmon.dll
6/21/2008 11:22:11 PM 123392 32 C:\Windows\System32\ifsutil.dll
6/21/2008 11:23:51 PM 438272 32 C:\Windows\System32\IKEEXT.DLL
6/21/2008 11:22:09 PM 153088 32 C:\Windows\System32\imagehlp.dll
6/21/2008 11:24:12 PM 705536 32 C:\Windows\System32\imagesp1.dll
6/21/2008 11:21:27 PM 105984 32 C:\Windows\System32\imapi.dll
6/21/2008 11:22:56 PM 320512 32 C:\Windows\System32\imapi2.dll
6/21/2008 11:23:29 PM 496128 32 C:\Windows\System32\imapi2fs.dll
6/21/2008 11:21:25 PM 36352 32 C:\Windows\System32\imgutil.dll
6/21/2008 11:23:35 PM 882176 32 C:\Windows\System32\IMJP10.IME
6/21/2008 11:23:45 PM 729088 32 C:\Windows\System32\IMJP10K.DLL
6/21/2008 11:22:49 PM 413184 32 C:\Windows\System32\imkr80.ime
6/21/2008 11:21:42 PM 114688 32 C:\Windows\System32\imm32.dll
6/21/2008 11:22:56 PM 738304 32 C:\Windows\System32\inetcomm.dll
6/21/2008 11:23:21 PM 1827840 32 C:\Windows\System32\inetcpl.cpl
6/21/2008 11:21:34 PM 52736 32 C:\Windows\System32\inetmib1.dll
6/21/2008 11:22:04 PM 120832 32 C:\Windows\System32\inetpp.dll
6/21/2008 11:21:19 PM 15360 32 C:\Windows\System32\inetppui.dll
6/21/2008 11:21:15 PM 11776 32 C:\Windows\System32\InfDefaultInstall.exe
6/21/2008 11:23:16 PM 88576 32 C:\Windows\System32\infocardapi.dll
6/21/2008 11:22:08 PM 28160 32 C:\Windows\System32\infocardcpl.cpl
6/21/2008 11:22:40 PM 217600 32 C:\Windows\System32\InkEd.dll
6/21/2008 11:22:04 PM 200704 32 C:\Windows\System32\input.dll
6/21/2008 11:21:27 PM 93696 32 C:\Windows\System32\inseng.dll
6/21/2008 11:21:42 PM 337408 32 C:\Windows\System32\intl.cpl
6/21/2008 11:22:43 PM 74240 32 C:\Windows\System32\IPBusEnum.dll
6/21/2008 11:21:25 PM 26624 32 C:\Windows\System32\ipconfig.exe
6/21/2008 11:22:48 PM 91648 32 C:\Windows\System32\IPHLPAPI.DLL
6/21/2008 11:23:31 PM 188416 32 C:\Windows\System32\iphlpsvc.dll
6/21/2008 11:22:18 PM 288256 32 C:\Windows\System32\ipnathlp.dll
6/21/2008 11:21:15 PM 8192 32 C:\Windows\System32\iprtprio.dll
6/21/2008 11:23:16 PM 252416 32 C:\Windows\System32\iprtrmgr.dll
6/21/2008 11:22:39 PM 758784 32 C:\Windows\System32\ipsecsnp.dll
6/21/2008 11:22:44 PM 361984 32 C:\Windows\System32\IPSECSVC.DLL
6/21/2008 11:22:46 PM 396288 32 C:\Windows\System32\ipsmsnap.dll
6/21/2008 11:21:21 PM 8192 32 C:\Windows\System32\iscsied.dll
6/21/2008 11:21:45 PM 111616 32 C:\Windows\System32\iscsiexe.dll
6/21/2008 11:21:12 PM 14848 32 C:\Windows\System32\iscsilog.dll
6/21/2008 11:21:23 PM 28160 32 C:\Windows\System32\iscsium.dll
6/21/2008 11:21:21 PM 64000 32 C:\Windows\System32\iscsiwmi.dll
6/21/2008 11:21:21 PM 141824 32 C:\Windows\System32\itss.dll
6/21/2008 11:21:27 PM 442368 32 C:\Windows\System32\joy.cpl
6/21/2008 11:23:40 PM 512000 32 C:\Windows\System32\jscript.dll
6/10/2008 3:27:23 PM 28160 32 C:\Windows\System32\jsproxy.dll
6/21/2008 11:21:12 PM 10752 32 C:\Windows\System32\KBDJPN.DLL
6/21/2008 11:21:12 PM 10240 32 C:\Windows\System32\KBDKOR.DLL
6/21/2008 11:22:06 PM 19512 32 C:\Windows\System32\kdcom.dll
6/21/2008 11:22:11 PM 21560 32 C:\Windows\System32\kdusb.dll
6/21/2008 11:23:45 PM 497664 32 C:\Windows\System32\kerberos.dll
6/21/2008 11:23:51 PM 888320 32 C:\Windows\System32\kernel32.dll
6/21/2008 11:21:30 PM 157696 32 C:\Windows\System32\keymgr.dll
6/21/2008 11:22:44 PM 68096 32 C:\Windows\System32\KMSVC.DLL
6/21/2008 11:21:40 PM 42496 32 C:\Windows\System32\korwbrkr.dll
6/21/2008 11:21:28 PM 144384 32 C:\Windows\System32\ksproxy.ax
6/21/2008 11:21:20 PM 69120 32 C:\Windows\System32\kstvtune.ax
6/21/2008 11:21:20 PM 43520 32 C:\Windows\System32\ksxbar.ax
6/21/2008 11:21:30 PM 13824 32 C:\Windows\System32\ktmutil.exe
6/21/2008 11:21:26 PM 12288 32 C:\Windows\System32\ktmw32.dll
6/21/2008 11:21:21 PM 53760 32 C:\Windows\System32\l2gpstore.dll
6/21/2008 11:22:45 PM 47616 32 C:\Windows\System32\l2nacp.dll
6/21/2008 11:22:15 PM 126976 32 C:\Windows\System32\L2SecHC.dll
6/21/2008 11:21:16 PM 62464 32 C:\Windows\System32\l3codeca.acm
6/21/2008 11:21:27 PM 220672 32 C:\Windows\System32\l3codecp.acm
6/21/2008 11:21:17 PM 25600 32 C:\Windows\System32\LangCleanupSysprepAction.dll
6/21/2008 11:21:21 PM 41984 32 C:\Windows\System32\licmgr10.dll
6/21/2008 11:21:18 PM 31232 32 C:\Windows\System32\lltdapi.dll
6/21/2008 11:22:49 PM 188928 32 C:\Windows\System32\lltdsvc.dll
6/21/2008 11:21:53 PM 40448 32 C:\Windows\System32\lnkstub.exe
6/21/2008 11:22:55 PM 113664 32 C:\Windows\System32\loadperf.dll
6/21/2008 11:23:28 PM 3662296 32 C:\Windows\System32\locale.nls
6/21/2008 11:22:54 PM 429056 32 C:\Windows\System32\localsec.dll
6/21/2008 11:23:52 PM 634880 32 C:\Windows\System32\localspl.dll
6/21/2008 11:21:17 PM 13824 32 C:\Windows\System32\localui.dll
6/21/2008 11:21:55 PM 40448 32 C:\Windows\System32\lodctr.exe
6/21/2008 11:21:27 PM 94720 32 C:\Windows\System32\logagent.exe
6/21/2008 11:22:16 PM 69632 32 C:\Windows\System32\loghours.dll
6/21/2008 11:21:23 PM 56320 32 C:\Windows\System32\logman.exe
6/21/2008 11:21:20 PM 5714432 32 C:\Windows\System32\logon.scr
6/21/2008 11:21:15 PM 9216 32 C:\Windows\System32\LogonUI.exe
6/21/2008 11:21:43 PM 23552 32 C:\Windows\System32\lpk.dll
6/21/2008 11:23:13 PM 179712 32 C:\Windows\System32\lpksetup.exe
6/21/2008 11:23:53 PM 41472 32 C:\Windows\System32\lpremove.exe
6/21/2008 11:23:52 PM 1255936 32 C:\Windows\System32\lsasrv.dll
6/21/2008 11:21:44 PM 9728 32 C:\Windows\System32\lsass.exe
6/21/2008 11:23:32 PM 229888 32 C:\Windows\System32\lsm.exe
6/21/2008 11:21:32 PM 19968 32 C:\Windows\System32\lsmproxy.dll
6/21/2008 11:21:27 PM 101376 32 C:\Windows\System32\luainstall.dll
6/21/2008 11:21:32 PM 98304 32 C:\Windows\System32\makecab.exe
6/21/2008 11:22:23 PM 939008 32 C:\Windows\System32\mblctr.exe
6/21/2008 11:22:49 PM 275968 32 C:\Windows\System32\mcbuilder.exe
6/21/2008 11:23:30 PM 852992 32 C:\Windows\System32\mcmde.dll
6/21/2008 11:23:42 PM 376376 32 C:\Windows\System32\mcupdate_GenuineIntel.dll
6/21/2008 11:21:54 PM 53760 32 C:\Windows\System32\Mcx2Svc.dll
6/21/2008 11:21:24 PM 129024 32 C:\Windows\System32\McxDriv.dll
6/21/2008 11:21:26 PM 205312 32 C:\Windows\System32\mdminst.dll
6/21/2008 11:22:40 PM 128512 32 C:\Windows\System32\MdSched.exe
6/21/2008 11:21:40 PM 356864 32 C:\Windows\System32\MediaMetadataHandler.dll
6/21/2008 11:23:47 PM 2867712 32 C:\Windows\System32\mf.dll
6/21/2008 11:23:34 PM 1135104 32 C:\Windows\System32\mfc42.dll
6/21/2008 11:23:35 PM 1160704 32 C:\Windows\System32\mfc42u.dll
6/21/2008 11:21:20 PM 26624 32 C:\Windows\System32\mfcsubs.dll
6/21/2008 11:21:43 PM 208896 32 C:\Windows\System32\mfplat.dll
6/21/2008 11:21:27 PM 24576 32 C:\Windows\System32\mfpmp.exe
6/21/2008 11:21:28 PM 98816 32 C:\Windows\System32\mfps.dll
6/21/2008 11:21:21 PM 62464 32 C:\Windows\System32\mfvdsp.dll
6/21/2008 11:21:42 PM 614400 32 C:\Windows\System32\MFWMAAEC.DLL
6/21/2008 11:21:16 PM 17408 32 C:\Windows\System32\midimap.dll
6/21/2008 11:22:15 PM 94776 32 C:\Windows\System32\MigAutoPlay.exe
6/21/2008 11:21:25 PM 95232 32 C:\Windows\System32\migisol.dll
6/21/2008 11:23:40 PM 2011648 32 C:\Windows\System32\milcore.dll
6/21/2008 11:21:18 PM 35328 32 C:\Windows\System32\mimefilt.dll
6/21/2008 11:21:56 PM 187904 32 C:\Windows\System32\mlang.dll
6/21/2008 11:23:39 PM 1792512 32 C:\Windows\System32\mmc.exe
6/21/2008 11:21:58 PM 301056 32 C:\Windows\System32\mmcbase.dll
6/21/2008 11:23:45 PM 2167808 32 C:\Windows\System32\mmcndmgr.dll
6/21/2008 11:21:34 PM 127488 32 C:\Windows\System32\mmcshext.dll
6/21/2008 11:21:48 PM 45056 32 C:\Windows\System32\mmcss.dll
6/21/2008 11:23:03 PM 149504 32 C:\Windows\System32\MMDevAPI.dll
6/21/2008 11:23:16 PM 1102848 32 C:\Windows\System32\mmsys.cpl
6/21/2008 11:21:21 PM 95744 32 C:\Windows\System32\mobsync.exe
6/21/2008 11:21:24 PM 287744 32 C:\Windows\System32\modemui.dll
6/21/2008 11:21:34 PM 13312 32 C:\Windows\System32\mountvol.exe
6/21/2008 11:21:19 PM 84480 32 C:\Windows\System32\MP3DMOD.DLL
6/21/2008 11:21:26 PM 259584 32 C:\Windows\System32\MP43DECD.DLL
6/21/2008 11:21:28 PM 317952 32 C:\Windows\System32\MP4SDECD.DLL
6/21/2008 11:21:43 PM 69632 32 C:\Windows\System32\Mpeg2Data.ax
6/21/2008 11:21:25 PM 177152 32 C:\Windows\System32\mpg2splt.ax
6/21/2008 11:21:26 PM 259584 32 C:\Windows\System32\MPG4DECD.DLL
6/21/2008 11:21:56 PM 68608 32 C:\Windows\System32\mpr.dll
6/21/2008 11:21:47 PM 97792 32 C:\Windows\System32\mprapi.dll
6/21/2008 11:23:11 PM 104960 32 C:\Windows\System32\mprddm.dll
6/21/2008 11:22:14 PM 68608 32 C:\Windows\System32\mprdim.dll
6/21/2008 11:22:17 PM 124928 32 C:\Windows\System32\mprmsg.dll
6/21/2008 11:23:44 PM 393216 32 C:\Windows\System32\MPSSVC.dll
6/21/2008 11:21:56 PM 120320 32 C:\Windows\System32\msaatext.dll
6/21/2008 11:22:16 PM 160256 32 C:\Windows\System32\MSAC3ENC.DLL
6/21/2008 11:22:20 PM 71680 32 C:\Windows\System32\msacm32.dll
6/21/2008 11:21:20 PM 21504 32 C:\Windows\System32\msacm32.drv
6/21/2008 11:21:32 PM 218624 32 C:\Windows\System32\mscandui.dll
6/21/2008 11:21:55 PM 391168 32 C:\Windows\System32\mscms.dll
6/21/2008 11:22:57 PM 227840 32 C:\Windows\System32\msconfig.exe
6/21/2008 11:23:51 PM 282112 32 C:\Windows\System32\mscoree.dll
6/21/2008 11:22:50 PM 158720 32 C:\Windows\System32\mscorier.dll
6/21/2008 11:23:28 PM 84480 32 C:\Windows\System32\mscories.dll
6/21/2008 11:23:16 PM 806912 32 C:\Windows\System32\msctf.dll
6/21/2008 11:21:20 PM 19456 32 C:\Windows\System32\MsCtfMonitor.dll
6/21/2008 11:21:21 PM 84992 32 C:\Windows\System32\msctfui.dll
6/21/2008 11:21:31 PM 159744 32 C:\Windows\System32\msdadiag.dll
6/21/2008 11:21:20 PM 126976 32 C:\Windows\System32\msdart.dll
6/21/2008 11:20:09 PM 305152 32 C:\Windows\System32\msdelta.dll
6/21/2008 11:21:45 PM 30720 32 C:\Windows\System32\msdmo.dll
6/21/2008 11:22:47 PM 415232 32 C:\Windows\System32\msdri.dll
6/21/2008 11:23:21 PM 329216 32 C:\Windows\System32\msdrm.dll
6/21/2008 11:22:19 PM 212992 32 C:\Windows\System32\msdt.dll
6/21/2008 11:22:01 PM 162304 32 C:\Windows\System32\msdt.exe
6/21/2008 11:21:22 PM 105984 32 C:\Windows\System32\msdtc.exe
6/21/2008 11:23:36 PM 344576 32 C:\Windows\System32\msdtckrm.dll
6/21/2008 11:22:01 PM 89088 32 C:\Windows\System32\msdtclog.dll
6/21/2008 11:23:43 PM 557568 32 C:\Windows\System32\msdtcprx.dll
6/21/2008 11:23:46 PM 1052160 32 C:\Windows\System32\msdtctm.dll
6/21/2008 11:23:12 PM 215040 32 C:\Windows\System32\msdtcuiu.dll
6/21/2008 11:22:54 PM 20992 32 C:\Windows\System32\msdtcVSp1res.dll
6/21/2008 11:21:12 PM 4096 32 C:\Windows\System32\msdxm.ocx
6/21/2008 11:21:20 PM 344064 32 C:\Windows\System32\msexcl40.dll
6/21/2008 11:22:23 PM 458240 32 C:\Windows\System32\msfeeds.dll
6/21/2008 11:21:24 PM 52224 32 C:\Windows\System32\msfeedsbs.dll
6/21/2008 11:21:16 PM 12800 32 C:\Windows\System32\msfeedssync.exe
6/21/2008 11:22:16 PM 564224 32 C:\Windows\System32\msftedit.dll
6/21/2008 11:21:21 PM 45568 32 C:\Windows\System32\mshta.exe
6/10/2008 3:27:26 PM 3578368 32 C:\Windows\System32\mshtml.dll
6/10/2008 3:27:22 PM 1383424 32 C:\Windows\System32\mshtml.tlb
6/21/2008 11:22:54 PM 476672 32 C:\Windows\System32\mshtmled.dll
6/21/2008 11:23:37 PM 2085888 32 C:\Windows\System32\msi.dll
6/21/2008 11:23:09 PM 475648 32 C:\Windows\System32\msidcrl30.dll
6/21/2008 11:21:20 PM 53248 32 C:\Windows\System32\msident.dll
6/21/2008 11:21:12 PM 8704 32 C:\Windows\System32\msidle.dll
6/21/2008 11:21:41 PM 296960 32 C:\Windows\System32\msieftp.dll
6/21/2008 11:21:28 PM 71680 32 C:\Windows\System32\msiexec.exe
6/21/2008 11:22:12 PM 332288 32 C:\Windows\System32\msihnd.dll
6/21/2008 11:21:28 PM 31232 32 C:\Windows\System32\msimtf.dll
6/21/2008 11:22:34 PM 408064 32 C:\Windows\System32\msinfo32.exe
6/21/2008 11:21:15 PM 19456 32 C:\Windows\System32\msisip.dll
6/21/2008 11:23:52 PM 1589248 32 C:\Windows\System32\msjet40.dll
6/21/2008 11:21:34 PM 368640 32 C:\Windows\System32\msjetoledb40.dll
6/21/2008 11:22:57 PM 299008 32 C:\Windows\System32\msjtes40.dll
6/21/2008 11:22:09 PM 156160 32 C:\Windows\System32\msls31.dll
6/21/2008 11:21:18 PM 245760 32 C:\Windows\System32\msltus40.dll
6/21/2008 11:21:14 PM 10752 32 C:\Windows\System32\msmmsp.dll
6/21/2008 11:23:44 PM 391680 32 C:\Windows\System32\MSMPEG2ADEC.DLL
6/21/2008 11:22:21 PM 506880 32 C:\Windows\System32\MSMPEG2ENC.DLL
6/21/2008 11:23:55 PM 588288 32 C:\Windows\System32\MSMPEG2VDEC.DLL
6/21/2008 11:21:51 PM 179712 32 C:\Windows\System32\msnetobj.dll
6/21/2008 11:21:42 PM 80896 32 C:\Windows\System32\MSNP.ax
6/21/2008 11:21:16 PM 58880 32 C:\Windows\System32\msobjs.dll
6/21/2008 11:21:45 PM 205824 32 C:\Windows\System32\msoeacct.dll
6/21/2008 11:21:35 PM 87552 32 C:\Windows\System32\msoert2.dll
6/21/2008 11:21:30 PM 180224 32 C:\Windows\System32\msorcl32.dll
6/21/2008 11:22:07 PM 485376 32 C:\Windows\System32\mspaint.exe
6/21/2008 11:20:09 PM 35328 32 C:\Windows\System32\mspatcha.dll
6/21/2008 11:21:18 PM 376832 32 C:\Windows\System32\mspbde40.dll
6/21/2008 11:22:49 PM 464896 32 C:\Windows\System32\msra.exe
6/21/2008 11:21:43 PM 193024 32 C:\Windows\System32\msrating.dll
6/21/2008 11:21:56 PM 344064 32 C:\Windows\System32\msrd3x40.dll
6/21/2008 11:21:44 PM 160256 32 C:\Windows\System32\msrdc.dll
6/21/2008 11:23:20 PM 647168 32 C:\Windows\System32\msrepl40.dll
6/21/2008 11:21:18 PM 23552 32 C:\Windows\System32\msscb.dll
6/21/2008 11:21:21 PM 51200 32 C:\Windows\System32\msscntrs.dll
6/21/2008 11:22:55 PM 414208 32 C:\Windows\System32\msscp.dll
6/21/2008 11:21:31 PM 110592 32 C:\Windows\System32\msscript.ocx
6/21/2008 11:23:21 PM 169472 32 C:\Windows\System32\mssha.dll
6/21/2008 11:23:27 PM 248832 32 C:\Windows\System32\msshsq.dll
6/21/2008 11:21:53 PM 98304 32 C:\Windows\System32\mssitlb.dll
6/21/2008 11:23:18 PM 333824 32 C:\Windows\System32\mssph.dll
6/21/2008 11:23:14 PM 167936 32 C:\Windows\System32\mssphtb.dll
6/21/2008 11:21:18 PM 32256 32 C:\Windows\System32\mssprxy.dll
6/21/2008 11:23:51 PM 1400832 32 C:\Windows\System32\mssrch.dll
6/21/2008 11:21:26 PM 52224 32 C:\Windows\System32\msstrc.dll
6/21/2008 11:23:12 PM 1696768 32 C:\Windows\System32\mssvp.dll
6/21/2008 11:22:06 PM 206336 32 C:\Windows\System32\mstask.dll
6/21/2008 11:21:21 PM 282624 32 C:\Windows\System32\mstext40.dll
6/10/2008 3:27:24 PM 671232 32 C:\Windows\System32\mstime.dll
6/21/2008 11:23:15 PM 83968 32 C:\Windows\System32\mstlsapi.dll
6/21/2008 11:23:48 PM 677888 32 C:\Windows\System32\mstsc.exe
6/21/2008 11:24:09 PM 2061824 32 C:\Windows\System32\mstscax.dll
6/21/2008 11:22:14 PM 163328 32 C:\Windows\System32\msutb.dll
6/21/2008 11:23:31 PM 210432 32 C:\Windows\System32\msv1_0.dll
6/21/2008 11:23:47 PM 1386496 32 C:\Windows\System32\msvbvm60.dll
6/21/2008 11:23:42 PM 680448 32 C:\Windows\System32\msvcrt.dll
6/21/2008 11:21:26 PM 123904 32 C:\Windows\System32\msvfw32.dll
6/21/2008 11:21:18 PM 31232 32 C:\Windows\System32\msvidc32.dll
6/21/2008 11:23:37 PM 1544704 32 C:\Windows\System32\MSVidCtl.dll
6/21/2008 11:22:10 PM 312320 32 C:\Windows\System32\mswmdm.dll
6/21/2008 11:23:33 PM 223232 32 C:\Windows\System32\mswsock.dll
6/21/2008 11:21:19 PM 450560 32 C:\Windows\System32\msxbde40.dll
6/21/2008 11:23:53 PM 1190400 32 C:\Windows\System32\msxml3.dll
6/21/2008 11:23:53 PM 1332224 32 C:\Windows\System32\msxml6.dll
6/21/2008 11:21:32 PM 124928 32 C:\Windows\System32\mtstocom.exe
6/21/2008 11:23:38 PM 307712 32 C:\Windows\System32\mtxclu.dll
6/21/2008 11:21:20 PM 22016 32 C:\Windows\System32\mtxdm.dll
6/21/2008 11:21:20 PM 27136 32 C:\Windows\System32\mtxlegih.dll
6/21/2008 11:22:05 PM 105472 32 C:\Windows\System32\mtxoci.dll
6/21/2008 11:22:52 PM 66048 32 C:\Windows\System32\MuiUnattend.exe
6/21/2008 11:22:08 PM 229888 32 C:\Windows\System32\mycomput.dll
6/21/2008 11:21:21 PM 135680 32 C:\Windows\System32\mydocs.dll
6/21/2008 11:21:23 PM 221184 32 C:\Windows\System32\Mystify.scr
6/21/2008 11:22:12 PM 46080 32 C:\Windows\System32\NAPCRYPT.DLL
6/21/2008 11:21:20 PM 67584 32 C:\Windows\System32\napdsnap.dll
6/21/2008 11:22:20 PM 103936 32 C:\Windows\System32\NAPHLPR.DLL
6/21/2008 11:21:34 PM 50176 32 C:\Windows\System32\NapiNSP.dll
6/21/2008 11:21:30 PM 34304 32 C:\Windows\System32\napipsec.dll
6/21/2008 11:22:53 PM 153600 32 C:\Windows\System32\NAPMONTR.DLL
6/21/2008 11:22:27 PM 267264 32 C:\Windows\System32\NAPSTAT.EXE
6/21/2008 11:23:32 PM 801280 32 C:\Windows\System32\NaturalLanguage6.dll
6/21/2008 11:21:20 PM 15360 32 C:\Windows\System32\nbtstat.exe
6/21/2008 11:21:17 PM 19968 32 C:\Windows\System32\NcdProp.dll
6/21/2008 11:22:17 PM 74240 32 C:\Windows\System32\nci.dll
6/21/2008 11:21:56 PM 48128 32 C:\Windows\System32\ncobjapi.dll
6/21/2008 11:23:20 PM 204288 32 C:\Windows\System32\ncrypt.dll
6/21/2008 11:23:17 PM 445952 32 C:\Windows\System32\ncryptui.dll
6/21/2008 11:22:43 PM 93184 32 C:\Windows\System32\ncsi.dll
6/21/2008 11:21:31 PM 135168 32 C:\Windows\System32\ndfapi.dll
6/21/2008 11:21:20 PM 29184 32 C:\Windows\System32\ndfetw.dll
6/21/2008 11:21:26 PM 48128 32 C:\Windows\System32\net.exe
6/21/2008 11:22:18 PM 158720 32 C:\Windows\System32\net1.exe
6/21/2008 11:23:30 PM 466944 32 C:\Windows\System32\netapi32.dll
6/21/2008 11:21:21 PM 21504 32 C:\Windows\System32\netbtugc.exe
6/21/2008 11:22:40 PM 2225664 32 C:\Windows\System32\netcenter.dll
6/21/2008 11:21:43 PM 25600 32 C:\Windows\System32\netcfg.exe
6/21/2008 11:23:14 PM 386560 32 C:\Windows\System32\netcfgx.dll
6/21/2008 11:22:21 PM 112128 32 C:\Windows\System32\netcorehc.dll
6/21/2008 11:22:22 PM 112128 32 C:\Windows\System32\netdiagfx.dll
6/21/2008 11:21:20 PM 17920 32 C:\Windows\System32\netevent.dll
6/21/2008 11:22:41 PM 119808 32 C:\Windows\System32\netid.dll
6/21/2008 11:22:02 PM 102912 32 C:\Windows\System32\netiohlp.dll
6/21/2008 11:21:28 PM 22528 32 C:\Windows\System32\netiougc.exe
6/21/2008 11:23:42 PM 592384 32 C:\Windows\System32\netlogon.dll
6/21/2008 11:22:45 PM 274432 32 C:\Windows\System32\netman.dll
6/21/2008 11:21:34 PM 180736 32 C:\Windows\System32\netplwiz.dll
6/21/2008 11:21:18 PM 25600 32 C:\Windows\System32\Netplwiz.exe
6/21/2008 11:21:42 PM 669696 32 C:\Windows\System32\netprof.dll
6/21/2008 11:23:14 PM 237056 32 C:\Windows\System32\netprofm.dll
6/21/2008 11:22:45 PM 1086464 32 C:\Windows\System32\NetProjW.dll
6/21/2008 11:23:04 PM 3173376 32 C:\Windows\System32\netshell.dll
6/21/2008 11:21:37 PM 2226688 32 C:\Windows\System32\networkexplorer.dll
6/21/2008 11:21:21 PM 39936 32 C:\Windows\System32\networkitemfactory.dll
6/21/2008 11:21:45 PM 3072000 32 C:\Windows\System32\networkmap.dll
6/21/2008 11:22:06 PM 183808 32 C:\Windows\System32\newdev.dll
6/21/2008 11:21:24 PM 48128 32 C:\Windows\System32\nlaapi.dll
6/21/2008 11:23:20 PM 168448 32 C:\Windows\System32\nlasvc.dll
6/21/2008 11:21:24 PM 122368 32 C:\Windows\System32\nlhtml.dll
6/21/2008 11:23:41 PM 154624 32 C:\Windows\System32\nlmgp.dll
6/21/2008 11:21:15 PM 57856 32 C:\Windows\System32\nlsbres.dll
6/21/2008 11:22:00 PM 1523712 32 C:\Windows\System32\NlsData0000.dll
6/21/2008 11:22:24 PM 2599936 32 C:\Windows\System32\NlsData0001.dll
6/21/2008 11:22:24 PM 1965056 32 C:\Windows\System32\NlsData0002.dll
6/21/2008 11:22:24 PM 1965056 32 C:\Windows\System32\NlsData0003.dll
6/21/2008 11:22:41 PM 2243072 32 C:\Windows\System32\NlsData0007.dll
6/21/2008 11:23:00 PM 4875776 32 C:\Windows\System32\NlsData0009.dll
6/21/2008 11:22:36 PM 9847296 32 C:\Windows\System32\NlsData000a.dll
6/21/2008 11:22:41 PM 2643456 32 C:\Windows\System32\NlsData000c.dll
6/21/2008 11:22:24 PM 2342912 32 C:\Windows\System32\NlsData000d.dll
6/21/2008 11:22:33 PM 1965056 32 C:\Windows\System32\NlsData000f.dll
6/21/2008 11:22:25 PM 4495360 32 C:\Windows\System32\NlsData0010.dll
6/21/2008 11:22:40 PM 2657280 32 C:\Windows\System32\NlsData0011.dll
6/21/2008 11:22:24 PM 3466752 32 C:\Windows\System32\NlsData0013.dll
6/21/2008 11:22:33 PM 1965056 32 C:\Windows\System32\NlsData0018.dll
6/21/2008 11:22:25 PM 4497408 32 C:\Windows\System32\NlsData0019.dll
6/21/2008 11:22:33 PM 1965056 32 C:\Windows\System32\NlsData001a.dll
6/21/2008 11:22:33 PM 1965056 32 C:\Windows\System32\NlsData001b.dll
6/21/2008 11:22:25 PM 4495360 32 C:\Windows\System32\NlsData001d.dll
6/21/2008 11:22:28 PM 3104768 32 C:\Windows\System32\NlsData0020.dll
6/21/2008 11:22:27 PM 1801216 32 C:\Windows\System32\NlsData0021.dll
6/21/2008 11:22:27 PM 1801216 32 C:\Windows\System32\NlsData0022.dll
6/21/2008 11:22:25 PM 1965056 32 C:\Windows\System32\NlsData0024.dll
6/21/2008 11:22:25 PM 1965056 32 C:\Windows\System32\NlsData0026.dll
6/21/2008 11:22:25 PM 1966592 32 C:\Windows\System32\NlsData0027.dll
6/21/2008 11:22:27 PM 1801216 32 C:\Windows\System32\NlsData002a.dll
6/21/2008 11:22:28 PM 3104768 32 C:\Windows\System32\NlsData0039.dll
6/21/2008 11:22:27 PM 1801216 32 C:\Windows\System32\NlsData003e.dll
6/21/2008 11:22:37 PM 3104768 32 C:\Windows\System32\NlsData0045.dll
6/21/2008 11:22:38 PM 3104768 32 C:\Windows\System32\NlsData0046.dll
6/21/2008 11:22:39 PM 3104768 32 C:\Windows\System32\NlsData0047.dll
6/21/2008 11:22:37 PM 3104768 32 C:\Windows\System32\NlsData0049.dll
6/21/2008 11:22:38 PM 3104768 32 C:\Windows\System32\NlsData004a.dll
6/21/2008 11:22:39 PM 3104768 32 C:\Windows\System32\NlsData004b.dll
6/21/2008 11:22:37 PM 3104768 32 C:\Windows\System32\NlsData004c.dll
6/21/2008 11:22:37 PM 3104768 32 C:\Windows\System32\NlsData004e.dll
6/21/2008 11:22:33 PM 4495360 32 C:\Windows\System32\NlsData0414.dll
6/21/2008 11:22:29 PM 4495360 32 C:\Windows\System32\NlsData0416.dll
6/21/2008 11:22:26 PM 4495360 32 C:\Windows\System32\NlsData0816.dll
6/21/2008 11:22:24 PM 1965056 32 C:\Windows\System32\NlsData081a.dll
6/21/2008 11:22:33 PM 1965056 32 C:\Windows\System32\NlsData0c1a.dll
6/21/2008 11:21:13 PM 25088 32 C:\Windows\System32\Nlsdl.dll
6/21/2008 11:21:28 PM 151040 32 C:\Windows\System32\notepad.exe
6/21/2008 11:21:41 PM 23552 32 C:\Windows\System32\nshhttp.dll
6/21/2008 11:21:28 PM 352256 32 C:\Windows\System32\nshipsec.dll
6/21/2008 11:21:20 PM 8192 32 C:\Windows\System32\nsi.dll
6/21/2008 11:21:27 PM 18432 32 C:\Windows\System32\nsisvc.dll
6/21/2008 11:21:56 PM 82944 32 C:\Windows\System32\nslookup.exe
6/21/2008 11:23:52 PM 1203792 32 C:\Windows\System32\ntdll.dll
6/21/2008 11:22:33 PM 88576 32 C:\Windows\System32\ntdsapi.dll
6/21/2008 11:24:13 PM 3600440 32 C:\Windows\System32\ntkrnlpa.exe
6/21/2008 11:22:45 PM 63488 32 C:\Windows\System32\ntlanman.dll
6/21/2008 11:21:58 PM 121344 32 C:\Windows\System32\ntmarta.dll
6/21/2008 11:24:13 PM 3548728 32 C:\Windows\System32\ntoskrnl.exe
6/21/2008 11:23:03 PM 216064 32 C:\Windows\System32\ntprint.dll
6/21/2008 11:22:19 PM 296960 32 C:\Windows\System32\ntshrui.dll
6/21/2008 11:22:46 PM 520704 32 C:\Windows\System32\ntvdm.exe
6/21/2008 11:23:19 PM 531456 32 C:\Windows\System32\objsel.dll
6/21/2008 11:21:53 PM 102912 32 C:\Windows\System32\occache.dll
6/21/2008 11:21:21 PM 35840 32 C:\Windows\System32\ocsetup.exe
6/21/2008 11:21:42 PM 409600 32 C:\Windows\System32\odbc32.dll
6/21/2008 11:21:20 PM 28672 32 C:\Windows\System32\odbcbcp.dll
6/21/2008 11:21:16 PM 40960 32 C:\Windows\System32\odbcconf.dll
6/21/2008 11:21:23 PM 114688 32 C:\Windows\System32\odbccp32.dll
6/21/2008 11:21:20 PM 77824 32 C:\Windows\System32\odbccr32.dll
6/21/2008 11:21:20 PM 77824 32 C:\Windows\System32\odbccu32.dll
6/21/2008 11:22:27 PM 319488 32 C:\Windows\System32\odbcjt32.dll
6/21/2008 11:21:21 PM 159744 32 C:\Windows\System32\odbctrac.dll
6/21/2008 11:21:43 PM 194560 32 C:\Windows\System32\offfilt.dll
6/21/2008 11:21:53 PM 1107456 32 C:\Windows\System32\ogldrv.dll
6/21/2008 11:23:43 PM 1315328 32 C:\Windows\System32\ole32.dll
6/21/2008 11:22:47 PM 215040 32 C:\Windows\System32\oleacc.dll
6/21/2008 11:23:32 PM 563200 32 C:\Windows\System32\oleaut32.dll
6/21/2008 11:21:27 PM 78848 32 C:\Windows\System32\olecli32.dll
6/21/2008 11:21:59 PM 101888 32 C:\Windows\System32\oledlg.dll
6/21/2008 11:22:16 PM 96768 32 C:\Windows\System32\oleprn.dll
6/21/2008 11:21:37 PM 88576 32 C:\Windows\System32\olepro32.dll
6/21/2008 11:21:22 PM 27648 32 C:\Windows\System32\olesvr32.dll
6/21/2008 11:21:22 PM 77824 32 C:\Windows\System32\olethk32.dll
6/21/2008 11:24:21 PM 1541120 32 C:\Windows\System32\onex.dll
6/21/2008 11:22:18 PM 261163 32 C:\Windows\System32\onex.tmf
6/21/2008 11:21:54 PM 2153472 32 C:\Windows\System32\oobefldr.dll
6/21/2008 11:21:17 PM 97280 32 C:\Windows\System32\OptionalFeatures.exe
6/21/2008 11:21:15 PM 19968 32 C:\Windows\System32\osbaseln.dll
6/21/2008 11:21:23 PM 42496 32 C:\Windows\System32\osblprov.dll
6/21/2008 11:22:16 PM 202240 32 C:\Windows\System32\P2P.dll
6/21/2008 11:21:51 PM 403968 32 C:\Windows\System32\p2pcollab.dll
6/21/2008 11:22:51 PM 336896 32 C:\Windows\System32\P2PGraph.dll
6/21/2008 11:21:30 PM 192000 32 C:\Windows\System32\p2phost.exe
6/21/2008 11:21:45 PM 134144 32 C:\Windows\System32\p2pnetsh.dll
6/21/2008 11:23:30 PM 658944 32 C:\Windows\System32\p2psvc.dll
6/21/2008 11:21:43 PM 26624 32 C:\Windows\System32\pcadm.dll
6/21/2008 11:21:28 PM 37888 32 C:\Windows\System32\pcasvc.dll
6/21/2008 11:23:26 PM 464384 32 C:\Windows\System32\pcaui.dll
6/21/2008 11:22:22 PM 242688 32 C:\Windows\System32\pdh.dll
6/21/2008 11:21:24 PM 46592 32 C:\Windows\System32\pdhui.dll
6/21/2008 11:22:46 PM 1248768 32 C:\Windows\System32\PerfCenterCPL.dll
6/21/2008 11:21:30 PM 120320 32 C:\Windows\System32\perfmon.exe
6/21/2008 11:21:08 PM 145455 32 C:\Windows\System32\perfmon.msc
6/21/2008 11:21:27 PM 19968 32 C:\Windows\System32\perfnet.dll
6/21/2008 11:21:34 PM 17408 32 C:\Windows\System32\perfts.dll
6/21/2008 11:23:13 PM 124928 32 C:\Windows\System32\phon.ime
6/21/2008 11:22:44 PM 412160 32 C:\Windows\System32\PhotoMetadataHandler.dll
6/21/2008 11:23:00 PM 704512 32 C:\Windows\System32\PhotoScreensaver.scr
6/21/2008 11:22:40 PM 291328 32 C:\Windows\System32\photowiz.dll
6/21/2008 11:24:09 PM 1107968 32 C:\Windows\System32\pidgenx.dll
6/21/2008 11:21:34 PM 15360 32 C:\Windows\System32\PING.EXE
6/21/2008 11:23:13 PM 89088 32 C:\Windows\System32\pintlgnt.ime
6/21/2008 11:20:28 PM 130560 32 C:\Windows\System32\PkgMgr.exe
6/21/2008 11:23:06 PM 1502208 32 C:\Windows\System32\pla.dll
6/21/2008 11:21:18 PM 17920 32 C:\Windows\System32\PlaySndSrv.dll
6/21/2008 11:21:45 PM 45056 32 C:\Windows\System32\pngfilt.dll
6/21/2008 11:22:58 PM 1823232 32 C:\Windows\System32\pnidui.dll
6/21/2008 11:21:56 PM 180736 32 C:\Windows\System32\pnpsetup.dll
6/21/2008 11:21:25 PM 10752 32 C:\Windows\System32\pnpts.dll
6/21/2008 11:21:54 PM 542208 32 C:\Windows\System32\pnpui.dll
6/21/2008 11:21:37 PM 58368 32 C:\Windows\System32\PnPUnattend.exe
6/21/2008 11:21:28 PM 32768 32 C:\Windows\System32\PnPutil.exe
6/21/2008 11:21:44 PM 69632 32 C:\Windows\System32\PNPXAssoc.dll
6/21/2008 11:21:44 PM 53248 32 C:\Windows\System32\PNPXAssocPrx.dll
6/21/2008 11:21:45 PM 62464 32 C:\Windows\System32\pnrpnsp.dll
6/21/2008 11:21:56 PM 272896 32 C:\Windows\System32\polstore.dll
6/21/2008 11:22:49 PM 272384 32 C:\Windows\System32\PortableDeviceApi.dll
6/21/2008 11:22:00 PM 94720 32 C:\Windows\System32\PortableDeviceClassExtension.dll
6/21/2008 11:22:02 PM 160768 32 C:\Windows\System32\PortableDeviceTypes.dll
6/21/2008 11:21:25 PM 124928 32 C:\Windows\System32\PortableDeviceWiaCompat.dll
6/21/2008 11:22:09 PM 196608 32 C:\Windows\System32\PortableDeviceWMDRM.dll
6/21/2008 11:21:27 PM 16896 32 C:\Windows\System32\pots.dll
6/21/2008 11:21:21 PM 163328 32 C:\Windows\System32\powercfg.cpl
6/21/2008 11:21:42 PM 723968 32 C:\Windows\System32\powercpl.dll
6/21/2008 11:21:27 PM 97280 32 C:\Windows\System32\powrprof.dll
6/21/2008 11:22:08 PM 106520 32 C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
6/21/2008 11:23:17 PM 350744 32 C:\Windows\System32\PresentationHost.exe
6/21/2008 11:22:52 PM 33304 32 C:\Windows\System32\PresentationHostProxy.dll
6/21/2008 11:24:06 PM 779800 32 C:\Windows\System32\PresentationNative_v0300.dll
6/21/2008 11:22:16 PM 160256 32 C:\Windows\System32\PresentationSettings.exe
6/21/2008 11:21:21 PM 26112 32 C:\Windows\System32\prevhost.exe
6/21/2008 11:21:31 PM 37888 32 C:\Windows\System32\printcom.dll
6/21/2008 11:21:52 PM 26112 32 C:\Windows\System32\printfilterpipelineprxy.dll
6/21/2008 11:23:41 PM 666112 32 C:\Windows\System32\printfilterpipelinesvc.exe
6/21/2008 11:23:19 PM 869888 32 C:\Windows\System32\printui.dll
6/21/2008 11:22:24 PM 551936 32 C:\Windows\System32\prnntfy.dll
6/21/2008 11:21:29 PM 119296 32 C:\Windows\System32\prntvpt.dll
6/25/2008 11:49:41 AM 53248 32 C:\Windows\System32\

---

Author: bamajim,  Posted: Wed Jul 09, 2008 8:18 pm    Post subject:

---

Isara

The log got cut off , please post the rest of the results

---

Author: Isara, Location: USA Posted: Thu Jul 10, 2008 3:33 pm    Post subject:

---

oops! thanks!

6/25/2008 11:49:41 AM 53248 32 C:\Windows\System32\Process.exe
6/21/2008 11:21:19 PM 7680 32 C:\Windows\System32\procinst.dll
6/21/2008 11:22:53 PM 29184 32 C:\Windows\System32\profprov.dll
6/21/2008 11:22:44 PM 153600 32 C:\Windows\System32\profsvc.dll
6/21/2008 11:21:26 PM 65536 32 C:\Windows\System32\propdefs.dll
6/21/2008 11:23:43 PM 750080 32 C:\Windows\System32\propsys.dll
6/21/2008 11:21:40 PM 191488 32 C:\Windows\System32\provthrd.dll
6/21/2008 11:21:19 PM 40448 32 C:\Windows\System32\psbase.dll
6/21/2008 11:24:13 PM 51768 32 C:\Windows\System32\PSHED.DLL
6/21/2008 11:22:18 PM 293376 32 C:\Windows\System32\psisdecd.dll
6/21/2008 11:21:41 PM 218624 32 C:\Windows\System32\psisrndr.ax
6/21/2008 11:22:06 PM 166400 32 C:\Windows\System32\puiapi.dll
6/21/2008 11:22:41 PM 300032 32 C:\Windows\System32\puiobj.dll
6/21/2008 11:23:18 PM 172544 32 C:\Windows\System32\QAGENT.DLL
6/21/2008 11:23:39 PM 302080 32 C:\Windows\System32\QAGENTRT.DLL
6/21/2008 11:21:33 PM 208896 32 C:\Windows\System32\qasf.dll
6/21/2008 11:21:33 PM 192000 32 C:\Windows\System32\qcap.dll
6/21/2008 11:21:35 PM 69632 32 C:\Windows\System32\QCLIPROV.DLL
6/21/2008 11:21:23 PM 281600 32 C:\Windows\System32\qdv.dll
6/21/2008 11:22:55 PM 497152 32 C:\Windows\System32\qdvd.dll
6/21/2008 11:21:46 PM 505344 32 C:\Windows\System32\qedit.dll
6/21/2008 11:23:13 PM 124928 32 C:\Windows\System32\qintlgnt.ime
6/21/2008 11:23:52 PM 758272 32 C:\Windows\System32\qmgr.dll
6/21/2008 11:22:50 PM 154112 32 C:\Windows\System32\QSHVHOST.DLL
6/21/2008 11:21:45 PM 81920 32 C:\Windows\System32\QSVRMGMT.DLL
6/10/2008 3:27:28 PM 1314816 32 C:\Windows\System32\quartz.dll
6/21/2008 11:23:44 PM 1381376 32 C:\Windows\System32\Query.dll
6/21/2008 11:23:13 PM 124928 32 C:\Windows\System32\quick.ime
6/21/2008 11:22:19 PM 79360 32 C:\Windows\System32\QUTIL.DLL
6/21/2008 11:22:21 PM 243712 32 C:\Windows\System32\qwave.dll
6/21/2008 11:21:20 PM 20480 32 C:\Windows\System32\RacAgent.exe
6/21/2008 11:23:55 PM 889344 32 C:\Windows\System32\RacEngn.dll
6/21/2008 11:21:17 PM 9987 32 C:\Windows\System32\RacUR.xml
6/21/2008 11:22:56 PM 286720 32 C:\Windows\System32\rasapi32.dll
6/21/2008 11:21:22 PM 90624 32 C:\Windows\System32\rasauto.dll
6/21/2008 11:22:16 PM 81408 32 C:\Windows\System32\rascfg.dll
6/21/2008 11:22:47 PM 281600 32 C:\Windows\System32\raschap.dll
6/21/2008 11:21:16 PM 15360 32 C:\Windows\System32\rasctrs.dll
6/21/2008 11:21:21 PM 52736 32 C:\Windows\System32\rasdiag.dll
6/21/2008 11:22:50 PM 825856 32 C:\Windows\System32\rasdlg.dll
6/21/2008 11:21:37 PM 161792 32 C:\Windows\System32\raserver.exe
6/21/2008 11:21:58 PM 642560 32 C:\Windows\System32\rasgcw.dll
6/21/2008 11:22:16 PM 71168 32 C:\Windows\System32\rasman.dll
6/21/2008 11:23:27 PM 260608 32 C:\Windows\System32\rasmans.dll
6/21/2008 11:21:41 PM 975360 32 C:\Windows\System32\RASMM.dll
6/21/2008 11:22:49 PM 155136 32 C:\Windows\System32\rasmontr.dll
6/21/2008 11:21:20 PM 39424 32 C:\Windows\System32\rasphone.exe
6/21/2008 11:21:27 PM 376832 32 C:\Windows\System32\rasplap.dll
6/21/2008 11:23:20 PM 259584 32 C:\Windows\System32\rasppp.dll
6/21/2008 11:21:56 PM 69632 32 C:\Windows\System32\rasqec.dll
6/21/2008 11:22:20 PM 69632 32 C:\Windows\System32\rastapi.dll
6/21/2008 11:23:19 PM 243712 32 C:\Windows\System32\rastls.dll
6/21/2008 11:21:14 PM 8704 32 C:\Windows\System32\rdpcfgex.dll
6/21/2008 11:22:54 PM 134656 32 C:\Windows\System32\rdpdd.dll
6/21/2008 11:22:52 PM 118272 32 C:\Windows\System32\RDPENCDD.dll
6/21/2008 11:23:54 PM 612864 32 C:\Windows\System32\rdpencom.dll
6/21/2008 11:23:22 PM 107008 32 C:\Windows\System32\rdpwsx.dll
6/21/2008 11:21:23 PM 30208 32 C:\Windows\System32\rdrleakdiag.exe
6/21/2008 11:23:50 PM 193024 32 C:\Windows\System32\recdisc.exe
6/21/2008 11:21:35 PM 60416 32 C:\Windows\System32\reg.exe
6/21/2008 11:22:08 PM 67584 32 C:\Windows\System32\regapi.dll
6/21/2008 11:21:21 PM 40960 32 C:\Windows\System32\RegCtrl.dll
6/21/2008 11:21:20 PM 44032 32 C:\Windows\System32\regini.exe
6/21/2008 11:22:46 PM 106496 32 C:\Windows\System32\regsvc.dll
6/21/2008 11:21:33 PM 42496 32 C:\Windows\System32\rekeywiz.exe
6/21/2008 11:22:23 PM 340992 32 C:\Windows\System32\RelMon.dll
6/21/2008 11:21:24 PM 58368 32 C:\Windows\System32\remotepg.dll
6/21/2008 11:21:27 PM 216576 32 C:\Windows\System32\RESAMPLEDMO.DLL
6/21/2008 11:21:43 PM 65536 32 C:\Windows\System32\resutils.dll
6/21/2008 11:21:21 PM 151552 32 C:\Windows\System32\rgb9rast.dll
6/21/2008 11:21:23 PM 220672 32 C:\Windows\System32\Ribbons.scr
6/21/2008 11:23:30 PM 456704 32 C:\Windows\System32\riched20.dll
6/21/2008 11:21:12 PM 8192 32 C:\Windows\System32\riched32.dll
6/21/2008 11:24:07 PM 510976 32 C:\Windows\System32\RMActivate.exe
6/21/2008 11:24:05 PM 523776 32 C:\Windows\System32\RMActivate_isv.exe
6/21/2008 11:23:55 PM 347136 32 C:\Windows\System32\RMActivate_ssp.exe
6/21/2008 11:23:55 PM 346624 32 C:\Windows\System32\RMActivate_ssp_isv.exe
6/21/2008 11:22:04 PM 87552 32 C:\Windows\System32\Robocopy.exe
6/21/2008 11:21:19 PM 17920 32 C:\Windows\System32\ROUTE.EXE
6/21/2008 11:22:54 PM 127488 32 C:\Windows\System32\rpchttp.dll
6/21/2008 11:21:26 PM 34816 32 C:\Windows\System32\RpcPing.exe
6/21/2008 11:23:54 PM 785408 32 C:\Windows\System32\rpcrt4.dll
6/21/2008 11:23:20 PM 547328 32 C:\Windows\System32\rpcss.dll
6/21/2008 11:21:30 PM 53248 32 C:\Windows\System32\rrinstaller.exe
6/21/2008 11:23:14 PM 242744 32 C:\Windows\System32\rsaenh.dll
6/21/2008 11:21:26 PM 43520 32 C:\Windows\System32\rshx32.dll
6/21/2008 11:21:47 PM 146944 32 C:\Windows\System32\RstrtMgr.dll
6/21/2008 11:21:21 PM 26624 32 C:\Windows\System32\rtffilt.dll
6/21/2008 11:22:14 PM 114688 32 C:\Windows\System32\rtm.dll
6/21/2008 11:21:26 PM 38400 32 C:\Windows\System32\runonce.exe
6/21/2008 11:22:06 PM 57344 32 C:\Windows\System32\samlib.dll
6/21/2008 11:23:35 PM 478720 32 C:\Windows\System32\samsrv.dll
6/21/2008 11:23:35 PM 322560 32 C:\Windows\System32\sbe.dll
6/21/2008 11:21:31 PM 153088 32 C:\Windows\System32\sbeio.dll
6/21/2008 11:21:17 PM 11776 32 C:\Windows\System32\sbunattend.exe
6/21/2008 11:22:13 PM 245760 32 C:\Windows\System32\scansetting.dll
6/21/2008 11:22:06 PM 95232 32 C:\Windows\System32\SCardSvr.dll
6/21/2008 11:22:08 PM 177152 32 C:\Windows\System32\scecli.dll
6/21/2008 11:21:53 PM 306176 32 C:\Windows\System32\scesrv.dll
6/21/2008 11:23:31 PM 268288 32 C:\Windows\System32\schannel.dll
6/21/2008 11:23:41 PM 596992 32 C:\Windows\System32\schedsvc.dll
6/21/2008 11:22:23 PM 151552 32 C:\Windows\System32\schtasks.exe
6/21/2008 11:23:14 PM 140288 32 C:\Windows\System32\scksp.dll
6/21/2008 11:23:04 PM 180224 32 C:\Windows\System32\scrobj.dll
6/21/2008 11:23:16 PM 172032 32 C:\Windows\System32\scrrun.dll
6/21/2008 11:21:25 PM 82944 32 C:\Windows\System32\sdchange.exe
6/21/2008 11:23:41 PM 1169408 32 C:\Windows\System32\sdclt.exe
6/21/2008 11:23:35 PM 730624 32 C:\Windows\System32\sdengin2.dll
6/21/2008 11:23:31 PM 183296 32 C:\Windows\System32\sdohlp.dll
6/21/2008 11:22:18 PM 104960 32 C:\Windows\System32\sdrsvc.dll
6/21/2008 11:22:01 PM 98816 32 C:\Windows\System32\sdshext.dll
6/21/2008 11:21:15 PM 6656 32 C:\Windows\System32\sdspres.dll
6/21/2008 11:21:46 PM 76800 32 C:\Windows\System32\SearchFilterHost.exe
6/21/2008 11:23:27 PM 302080 32 C:\Windows\System32\SearchIndexer.exe
6/21/2008 11:23:06 PM 179200 32 C:\Windows\System32\SearchProtocolHost.exe
6/21/2008 11:21:32 PM 35328 32 C:\Windows\System32\SecEdit.exe
6/21/2008 11:21:31 PM 19968 32 C:\Windows\System32\seclogon.dll
6/21/2008 11:24:05 PM 472064 32 C:\Windows\System32\secproc.dll
6/21/2008 11:24:03 PM 472576 32 C:\Windows\System32\secproc_isv.dll
6/21/2008 11:21:47 PM 151040 32 C:\Windows\System32\secproc_ssp.dll
6/21/2008 11:21:47 PM 151040 32 C:\Windows\System32\secproc_ssp_isv.dll
6/21/2008 11:22:28 PM 72704 32 C:\Windows\System32\secur32.dll
6/21/2008 11:21:27 PM 69632 32 C:\Windows\System32\sendmail.dll
6/21/2008 11:21:32 PM 47104 32 C:\Windows\System32\Sens.dll
6/21/2008 11:21:17 PM 15360 32 C:\Windows\System32\serialui.dll
6/21/2008 11:22:59 PM 279040 32 C:\Windows\System32\services.exe
6/21/2008 11:22:56 PM 84992 32 C:\Windows\System32\SessEnv.dll
6/21/2008 11:21:54 PM 626688 32 C:\Windows\System32\sethc.exe
6/21/2008 11:23:32 PM 1590272 32 C:\Windows\System32\setupapi.dll
6/21/2008 11:22:14 PM 41984 32 C:\Windows\System32\setupcl.exe
6/21/2008 11:21:21 PM 110592 32 C:\Windows\System32\setupcln.dll
6/21/2008 11:21:17 PM 13312 32 C:\Windows\System32\setupSNK.exe
6/21/2008 11:21:45 PM 85504 32 C:\Windows\System32\setupugc.exe
6/21/2008 11:21:25 PM 15872 32 C:\Windows\System32\sfc.exe
6/21/2008 11:21:27 PM 38912 32 C:\Windows\System32\sfc_os.dll
6/21/2008 11:21:30 PM 81920 32 C:\Windows\System32\shacct.dll
6/21/2008 11:23:10 PM 1067520 32 C:\Windows\System32\shdocvw.dll
6/21/2008 11:24:18 PM 11580416 32 C:\Windows\System32\shell32.dll
6/21/2008 11:21:26 PM 68608 32 C:\Windows\System32\shgina.dll
6/21/2008 11:21:32 PM 128000 32 C:\Windows\System32\shimgvw.dll
6/21/2008 11:23:41 PM 351744 32 C:\Windows\System32\shlwapi.dll
6/21/2008 11:22:48 PM 105984 32 C:\Windows\System32\shrink.dll
6/21/2008 11:21:27 PM 396288 32 C:\Windows\System32\shrpubw.exe
6/21/2008 11:22:20 PM 101376 32 C:\Windows\System32\shsetup.dll
6/21/2008 11:23:03 PM 247296 32 C:\Windows\System32\shsvcs.dll
6/21/2008 11:21:23 PM 29696 32 C:\Windows\System32\shutdown.exe
6/21/2008 11:21:40 PM 425472 32 C:\Windows\System32\shwebsvc.dll
6/24/2008 4:33:42 PM 19456 32 C:\Windows\System32\sigma64.dll
6/21/2008 11:23:38 PM 225792 32 C:\Windows\System32\SLC.dll
6/21/2008 11:21:40 PM 777216 32 C:\Windows\System32\slcc.dll
6/21/2008 11:21:40 PM 137216 32 C:\Windows\System32\SLCExt.dll
6/21/2008 11:21:59 PM 42496 32 C:\Windows\System32\slcinst.dll
6/21/2008 11:22:52 PM 573440 32 C:\Windows\System32\SLCommDlg.dll
6/21/2008 11:21:21 PM 186368 32 C:\Windows\System32\SLLUA.exe
6/21/2008 11:21:55 PM 80047 32 C:\Windows\System32\slmgr.vbs
6/21/2008 11:24:21 PM 2623488 32 C:\Windows\System32\SLsvc.exe
6/21/2008 11:22:49 PM 354304 32 C:\Windows\System32\SLUI.exe
6/21/2008 11:22:04 PM 57856 32 C:\Windows\System32\SLUINotify.dll
6/21/2008 11:21:17 PM 12288 32 C:\Windows\System32\slwga.dll
6/21/2008 11:21:40 PM 35328 32 C:\Windows\System32\slwmi.dll
6/21/2008 11:22:51 PM 134144 32 C:\Windows\System32\SmartcardCredentialProvider.dll
6/21/2008 11:23:47 PM 83456 32 C:\Windows\System32\SMBHelperClass.dll
6/21/2008 11:20:34 PM 704512 32 C:\Windows\System32\SmiEngine.dll
6/21/2008 11:20:34 PM 139264 32 C:\Windows\System32\SmiInstaller.dll
6/21/2008 11:22:17 PM 64000 32 C:\Windows\System32\smss.exe
6/21/2008 11:21:57 PM 197632 32 C:\Windows\System32\SndVol.exe
6/21/2008 11:21:56 PM 275968 32 C:\Windows\System32\SnippingTool.exe
6/21/2008 11:21:24 PM 125440 32 C:\Windows\System32\softkbd.dll
6/21/2008 11:21:34 PM 127488 32 C:\Windows\System32\SoundRecorder.exe
6/21/2008 11:22:36 PM 64512 32 C:\Windows\System32\spbcd.dll
6/21/2008 11:23:16 PM 163840 32 C:\Windows\System32\spoolss.dll
6/21/2008 11:22:10 PM 125952 32 C:\Windows\System32\spoolsv.exe
6/21/2008 11:21:17 PM 15872 32 C:\Windows\System32\spopk.dll
6/21/2008 11:22:50 PM 142336 32 C:\Windows\System32\spp.dll
6/21/2008 11:21:31 PM 44544 32 C:\Windows\System32\sppnp.dll
6/21/2008 11:22:49 PM 348160 32 C:\Windows\System32\spwizeng.dll
6/21/2008 11:23:54 PM 8322048 32 C:\Windows\System32\spwizimg.dll
6/21/2008 11:21:10 PM 7680 32 C:\Windows\System32\spwizres.dll
6/21/2008 11:21:12 PM 7680 32 C:\Windows\System32\spwmp.dll
6/21/2008 11:23:32 PM 604160 32 C:\Windows\System32\sqlceqp30.dll
6/21/2008 11:23:26 PM 308224 32 C:\Windows\System32\sqlcese30.dll
6/21/2008 11:23:18 PM 520192 32 C:\Windows\System32\sqlsrv32.dll
6/21/2008 11:23:13 PM 129536 32 C:\Windows\System32\sqmapi.dll
6/21/2008 11:23:11 PM 258048 32 C:\Windows\System32\srchadmin.dll
6/25/2008 11:49:41 AM 288417 32 C:\Windows\System32\SrchSTS.exe
6/21/2008 11:22:49 PM 274944 32 C:\Windows\System32\srrstr.dll
6/21/2008 11:22:55 PM 122880 32 C:\Windows\System32\srvsvc.dll
6/21/2008 11:21:20 PM 24064 32 C:\Windows\System32\srwmi.dll
6/21/2008 11:22:22 PM 8139264 32 C:\Windows\System32\ssBranded.scr
6/21/2008 11:22:05 PM 155648 32 C:\Windows\System32\ssdpsrv.dll
6/21/2008 11:23:42 PM 109056 32 C:\Windows\System32\SSShim.dll
6/21/2008 11:21:41 PM 294912 32 C:\Windows\System32\ssText3d.scr
6/21/2008 11:24:09 PM 116736 32 C:\Windows\System32\sstpsvc.dll
6/21/2008 11:21:23 PM 251904 32 C:\Windows\System32\sti_ci.dll
6/21/2008 11:22:18 PM 586752 32 C:\Windows\System32\stobject.dll
6/21/2008 11:22:45 PM 55808 32 C:\Windows\System32\Storprop.dll
6/21/2008 11:21:20 PM 100043 32 C:\Windows\System32\StructuredQuerySchema.bin
6/21/2008 11:22:06 PM 1224192 32 C:\Windows\System32\sud.dll
6/21/2008 11:21:40 PM 21504 32 C:\Windows\System32\svchost.exe
6/21/2008 11:23:37 PM 310784 32 C:\Windows\System32\swprv.dll
6/25/2008 11:49:41 AM 135168 32 C:\Windows\System32\swreg.exe
6/25/2008 11:49:41 AM 40960 32 C:\Windows\System32\swsc.exe
6/21/2008 11:21:21 PM 28160 32 C:\Windows\System32\sxproxy.dll
6/21/2008 11:22:44 PM 376832 32 C:\Windows\System32\sxs.dll
6/21/2008 11:21:18 PM 22016 32 C:\Windows\System32\sxsstore.dll
6/21/2008 11:21:30 PM 27136 32 C:\Windows\System32\sxstrace.exe
6/21/2008 11:22:09 PM 2204672 32 C:\Windows\System32\SyncCenter.dll
6/21/2008 11:22:59 PM 75776 32 C:\Windows\System32\synceng.dll
6/21/2008 11:21:40 PM 175616 32 C:\Windows\System32\syncui.dll
6/21/2008 11:22:45 PM 242688 32 C:\Windows\System32\sysdm.cpl
6/21/2008 11:21:33 PM 338944 32 C:\Windows\System32\SysFxUI.dll
6/21/2008 11:21:20 PM 27648 32 C:\Windows\System32\syskey.exe
6/21/2008 11:24:07 PM 574976 32 C:\Windows\System32\sysmain.dll
6/21/2008 11:22:06 PM 389632 32 C:\Windows\System32\sysmon.ocx
6/21/2008 11:21:55 PM 47104 32 C:\Windows\System32\syssetup.dll
6/21/2008 11:22:17 PM 842752 32 C:\Windows\System32\systemcpl.dll
6/21/2008 11:21:43 PM 76288 32 C:\Windows\System32\systeminfo.exe
6/21/2008 11:23:34 PM 132148 32 C:\Windows\System32\systemsf.ebd
6/21/2008 11:22:15 PM 155648 32 C:\Windows\System32\t2embed.dll
6/21/2008 11:21:19 PM 94208 32 C:\Windows\System32\Tabbtn.dll
6/21/2008 11:21:19 PM 52224 32 C:\Windows\System32\TabbtnEx.dll
6/21/2008 11:21:23 PM 61952 32 C:\Windows\System32\tabcal.exe
6/21/2008 11:21:43 PM 691200 32 C:\Windows\System32\TabletPC.cpl
6/21/2008 11:21:28 PM 51712 32 C:\Windows\System32\takeown.exe
6/21/2008 11:21:29 PM 98304 32 C:\Windows\System32\TapiMigPlugin.dll
6/21/2008 11:22:05 PM 242688 32 C:\Windows\System32\tapisrv.dll
6/21/2008 11:23:13 PM 270336 32 C:\Windows\System32\taskcomp.dll
6/21/2008 11:22:57 PM 169472 32 C:\Windows\System32\taskeng.exe
6/21/2008 11:21:41 PM 78848 32 C:\Windows\System32\taskkill.exe
6/21/2008 11:21:30 PM 80896 32 C:\Windows\System32\tasklist.exe
6/21/2008 11:21:36 PM 163840 32 C:\Windows\System32\taskmgr.exe
6/21/2008 11:23:15 PM 357376 32 C:\Windows\System32\taskschd.dll
6/21/2008 11:21:21 PM 11776 32 C:\Windows\System32\tbs.dll
6/21/2008 11:21:41 PM 56320 32 C:\Windows\System32\tbssvc.dll
6/21/2008 11:22:44 PM 170496 32 C:\Windows\System32\tcpipcfg.dll
6/21/2008 11:22:48 PM 135168 32 C:\Windows\System32\tcpmon.dll
6/21/2008 11:22:37 PM 60124 32 C:\Windows\System32\tcpmon.ini
6/21/2008 11:21:25 PM 66560 32 C:\Windows\System32\tdc.ocx
6/21/2008 11:22:56 PM 431104 32 C:\Windows\System32\tdh.dll
6/21/2008 11:22:05 PM 355328 32 C:\Windows\System32\termmgr.dll
6/21/2008 11:23:46 PM 448512 32 C:\Windows\System32\termsrv.dll
6/21/2008 11:23:19 PM 1152000 32 C:\Windows\System32\themecpl.dll
6/21/2008 11:22:00 PM 615424 32 C:\Windows\System32\themeui.dll
6/21/2008 11:23:30 PM 80384 32 C:\Windows\System32\thumbcache.dll
6/21/2008 11:22:01 PM 714240 32 C:\Windows\System32\timedate.cpl
6/21/2008 11:21:21 PM 43008 32 C:\Windows\System32\TimeDateMUICallback.dll
6/21/2008 11:23:13 PM 125952 32 C:\Windows\System32\tintlgnt.ime
6/21/2008 11:21:26 PM 1298432 32 C:\Windows\System32\TMM.dll
6/21/2008 11:21:24 PM 86528 32 C:\Windows\System32\TpmInit.exe
6/21/2008 11:23:49 PM 1505792 32 C:\Windows\System32\tquery.dll
6/21/2008 11:22:52 PM 337408 32 C:\Windows\System32\tracerpt.exe
6/21/2008 11:21:54 PM 75264 32 C:\Windows\System32\trkwks.dll
6/21/2008 11:21:25 PM 63488 32 C:\Windows\System32\tscupgrd.exe
6/21/2008 11:21:12 PM 14336 32 C:\Windows\System32\tsddd.dll
6/21/2008 11:23:11 PM 53248 32 C:\Windows\System32\tsgqec.dll
6/21/2008 11:22:22 PM 62464 32 C:\Windows\System32\TSpkg.dll
6/21/2008 11:21:24 PM 41984 32 C:\Windows\System32\TSTheme.exe
6/21/2008 11:23:50 PM 28672 32 C:\Windows\System32\TsWpfWrp.exe
6/21/2008 11:21:41 PM 89088 32 C:\Windows\System32\txflog.dll
6/21/2008 11:21:27 PM 10752 32 C:\Windows\System32\txfw32.dll
6/21/2008 11:21:21 PM 45568 32 C:\Windows\System32\ucsvc.exe
6/21/2008 11:23:10 PM 208384 32 C:\Windows\System32\uDWM.dll
6/21/2008 11:23:27 PM 56320 32 C:\Windows\System32\uexfat.dll
6/21/2008 11:21:21 PM 92672 32 C:\Windows\System32\ufat.dll
6/21/2008 11:21:26 PM 35840 32 C:\Windows\System32\UI0Detect.exe
6/21/2008 11:21:28 PM 152064 32 C:\Windows\System32\UIAutomationCore.dll
6/21/2008 11:21:36 PM 2588160 32 C:\Windows\System32\UIHub.dll
6/21/2008 11:21:54 PM 99840 32 C:\Windows\System32\ulib.dll
6/21/2008 11:22:42 PM 51712 32 C:\Windows\System32\umb.dll
6/21/2008 11:23:08 PM 221696 32 C:\Windows\System32\umpnpmgr.dll
6/21/2008 11:21:53 PM 201216 32 C:\Windows\System32\unattend.dll
6/21/2008 11:21:21 PM 28160 32 C:\Windows\System32\unattendedjoin.exe
6/21/2008 11:22:48 PM 736768 32 C:\Windows\System32\unbcl.dll
6/21/2008 11:21:27 PM 280064 32 C:\Windows\System32\unimdm.tsp
6/21/2008 11:21:55 PM 33792 32 C:\Windows\System32\unlodctr.exe
6/21/2008 11:21:26 PM 310784 32 C:\Windows\System32\unregmp2.exe
6/21/2008 11:23:27 PM 322560 32 C:\Windows\System32\untfs.dll
6/21/2008 11:21:35 PM 195584 32 C:\Windows\System32\upnp.dll
6/21/2008 11:21:20 PM 22528 32 C:\Windows\System32\upnpcont.exe
6/21/2008 11:22:17 PM 259072 32 C:\Windows\System32\upnphost.dll
6/21/2008 11:21:15 PM 105984 32 C:\Windows\System32\url.dll
6/10/2008 3:27:25 PM 1166336 32 C:\Windows\System32\urlmon.dll
6/21/2008 11:22:09 PM 34304 32 C:\Windows\System32\usbmon.dll
6/21/2008 11:21:17 PM 11264 32 C:\Windows\System32\usbperf.dll
6/21/2008 11:21:20 PM 83456 32 C:\Windows\System32\usbui.dll
6/21/2008 11:23:40 PM 627200 32 C:\Windows\System32\user32.dll
6/21/2008 11:21:45 PM 1123840 32 C:\Windows\System32\usercpl.dll
6/21/2008 11:22:43 PM 108032 32 C:\Windows\System32\userenv.dll
6/21/2008 11:21:30 PM 25088 32 C:\Windows\System32\userinit.exe
6/21/2008 11:23:35 PM 501760 32 C:\Windows\System32\usp10.dll
6/21/2008 11:21:24 PM 29696 32 C:\Windows\System32\utildll.dll
6/21/2008 11:21:54 PM 638976 32 C:\Windows\System32\Utilman.exe
6/21/2008 11:22:08 PM 130560 32 C:\Windows\System32\uudf.dll
6/21/2008 11:21:36 PM 28672 32 C:\Windows\System32\uxsms.dll
6/21/2008 11:22:56 PM 240128 32 C:\Windows\System32\uxtheme.dll
6/25/2008 11:49:41 AM 86528 32 C:\Windows\System32\VACFix.exe
6/21/2008 11:22:42 PM 257024 32 C:\Windows\System32\VAN.dll
6/21/2008 11:21:43 PM 164864 32 C:\Windows\System32\VBICodec.ax
6/21/2008 11:21:17 PM 31232 32 C:\Windows\System32\vbisurf.ax
6/21/2008 11:23:38 PM 430080 32 C:\Windows\System32\vbscript.dll
6/25/2008 11:49:41 AM 289144 32 C:\Windows\System32\VCCLSID.exe
6/21/2008 11:21:15 PM 17408 32 C:\Windows\System32\vdmdbg.dll
6/21/2008 11:21:24 PM 41984 32 C:\Windows\System32\vdmredir.dll
6/21/2008 11:23:49 PM 382976 32 C:\Windows\System32\vds.exe
6/21/2008 11:23:38 PM 152064 32 C:\Windows\System32\vdsbas.dll
6/21/2008 11:23:40 PM 507904 32 C:\Windows\System32\vdsdyn.dll
6/21/2008 11:21:58 PM 19968 32 C:\Windows\System32\vdsldr.exe
6/21/2008 11:23:29 PM 126976 32 C:\Windows\System32\vdsutil.dll
6/21/2008 11:21:23 PM 37888 32 C:\Windows\System32\vds_ps.dll
6/21/2008 11:21:47 PM 157696 32 C:\Windows\System32\verifier.dll
6/21/2008 11:22:01 PM 112640 32 C:\Windows\System32\verifier.exe
6/21/2008 11:21:26 PM 20480 32 C:\Windows\System32\version.dll
6/21/2008 11:21:20 PM 56832 32 C:\Windows\System32\vfwwdm32.dll
6/21/2008 11:21:11 PM 10752 32 C:\Windows\System32\vga.dll
6/21/2008 11:21:12 PM 56320 32 C:\Windows\System32\vga256.dll
6/21/2008 11:21:11 PM 21504 32 C:\Windows\System32\vga64k.dll
6/21/2008 11:21:20 PM 246272 32 C:\Windows\System32\VIDRESZR.DLL
6