Analysis
-
max time kernel
151s -
max time network
80s -
platform
windows7_x64 -
resource
win7 -
submitted
10/07/2020, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
svchost.exe
-
Size
53KB
-
MD5
56c6989cb4ee5c63605d3a7e58d3285b
-
SHA1
b2cfad633149f0a37d903eed41ff51b0442c2c82
-
SHA256
5a9bdca3321b536a65ceacfda2871b1de18abe69c9fc323329286b7908ecb485
-
SHA512
7833202d59c144de3e2ec3e18538dadd6d11ee2f18cc76b974e8132c369b6c47c93cb7eafd5d7e1e96b5798f9786cae92953293f27607a872770e45b3ca40194
Score
7/10
Malware Config
Signatures
-
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe" svchost.exe -
Drops desktop.ini file(s) 29 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Public\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Public\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini svchost.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Program Files\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Public\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 6813 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_italic.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_04.MID svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libhds_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCVDT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15274_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlcese35.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15035_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18255_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0160590.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0227419.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ca.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\STORYVERTBB.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239943.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageStyle.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02405_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0148798.JPG svchost.exe File created C:\Program Files\Microsoft Office\Office14\PROOF\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WZCNFLCT.CHM svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18214_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00737_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\DEFAULT.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterApplicationDescriptors.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01842_.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0150861.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.Infopath.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RSSITEML.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01243_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateHelper.msi svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14883_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382970.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN01164_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\PersonalContact.ico svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONENOTE_COL.HXC svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tijuana svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00808_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090390.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\attention.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0196374.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\management\management.properties svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfxmedia.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01358_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03014_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01006_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Country.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188669.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXT svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ORIG98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GRAPH.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BZCARDHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OSPP.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OFFOWCI.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\LOOKUP.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\BlackTieMergeLetter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN086.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00373_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\ISO690Nmerical.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\TexturedBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Status Report.fdt svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\IPEDINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183172.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01905_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0213243.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FLYERHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCAL.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Sort\AUTHOR.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0304875.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\HAMMER.WAV svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RTFHTML.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\TOC98.POC svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\axvlc.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14513_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00351_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIcons.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLPERF.INI svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199473.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD.DEV.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSEvents.man svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00809_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NBOOK_01.MID svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21339_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NL7MODELS0009.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03011U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18223_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0222017.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\CT_ROOTS.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\ACCWIZ\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2native.dll svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ms.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105386.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02466U.BMP svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\management\jmxremote.password.template svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib svchost.exe File created C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ENGIDX.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\OLMAIL.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10337_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099177.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382947.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00525_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341653.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01866_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02067_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\DBGHELP.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\GIFT98.POC svchost.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUM2396.tmp\GoogleUpdateSetup.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME07.CSS svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime.css svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\WARN.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\XPAGE3C.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LETTHEAD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\EXITEM.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0174639.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153265.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21300_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18231_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01180_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\VIEW.JS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Karachi svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\TimeCard.xltx svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21348_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jli.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSPST32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0183328.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0293236.WMF svchost.exe File created C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\LAUNCH.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239997.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02208U.BMP svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\INVITE.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWSHM.POC svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Sort\TAG.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107026.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15020_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105506.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153273.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\Bibliography\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02153_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Merida svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18236_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01748_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00372_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0233312.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0301044.WMF svchost.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lv.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.BusinessData.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\IMAGE.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02435_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105974.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Foundry.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01080_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\WINWORD.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_tr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187893.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\XML2WORD.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PPINTL.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR20F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00416_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSProxy.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGLOGO.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAProject.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\LINES.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01770_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\server\classes.jsa svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21315_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageScript.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBOXES.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0390072.JPG svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN020.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21534_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387591.JPG svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7cm_es.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR43B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guayaquil svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ur.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14831_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\TURABIAN.XSL svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EXCEL.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0304933.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0282126.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02127_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages.properties svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\NOTEBOOK.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.TH.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\InfoPathOM\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_off.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CERT98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_09.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\COUGH.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\MENU98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKDECS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Wordcnvr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\OLADD.FAE svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\FLASH.NET.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Ojinaga svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSWORD.OLB svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Response.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14980_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0172067.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.BusinessData.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_off.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PROG98.POC svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLVBS.DLL svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EntityPicker.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Installed_resources14.xss svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03668_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Concourse.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NAMECONTROLPROXY.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Discussion14.gta svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Contacts.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198712.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING2.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02116_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL081.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285782.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\WET svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Bissau svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7jp.kic svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01785_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR35F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Austin.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7fr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\PACBELL.NET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01158_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ExecutiveReport.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15173_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281630.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mexico_City svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL108.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR5F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02282_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01171_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00234_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2 svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR3F.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PSRCHKEY.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00544_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWCUTCHR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_OFF.GIF svchost.exe File created C:\Program Files\Microsoft Office\Office14\AccessWeb\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21331_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\InkSeg.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB6.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REPLTMPL.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME29.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10267_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02288_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18237_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0187423.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Executive.eftx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Manila svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Contacts.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ENVELOPR.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRINTL32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15277_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\dnsns.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.HK.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Currency Rates.iqy svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR24F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\localedata.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NL7MODELS000C.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Wordconv.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BUTTON.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178932.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\sunmscapi.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7cm_en.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\OFFLINE.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR36B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Windows Journal\jnwdui.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\RELAY.CER svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02082_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00919_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00116_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AccessWeb\CLNTWRAP.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107494.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00542_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADVZIP.DIC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CATWIZ11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00555_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CALSO98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ja.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL_COL.HXT svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_gu.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Apothecary.thmx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0386485.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBAD.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099153.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\ALERT.ICO svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE01797_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\RTF_BOLD.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15059_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199279.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01746_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN027.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR11F.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jce.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLRPC.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RESENDS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\tzmappings svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GKExcel.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hebron svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185786.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\zip.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\Analysis\PROCDB.XLAM svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MET svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LETTHEAD.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341636.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OneNote\SendToOneNoteNames.gpd svchost.exe File created C:\Program Files\Microsoft Office\Office14\Library\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187883.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182888.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEV.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01743_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099152.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll svchost.exe File created C:\Program Files\Java\jre7\bin\dtplugin\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\WIND.WAV svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boise svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01255G.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341557.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BRCHUR11.POC svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUDIOSEARCHLTS.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\libxml2.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0186360.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00560_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME53.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21413_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SMSL.ICO svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\XML Files\Messenger.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LOGO98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTVIEW.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199283.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Composite.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00578_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSN.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWRECE.DLL svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00468_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN090.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01015_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Iqaluit svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SHAREPOINTPROVIDER.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Origin.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK svchost.exe File opened for modification C:\Program Files\UnregisterRevoke.ogg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21366_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Thatch.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099164.WMF svchost.exe File created C:\Program Files\Java\jre7\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\wsdetect.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EssentialLetter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0211949.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR25F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18233_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200273.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02285_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Noronha svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN044.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\CHIMES.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216600.WMF svchost.exe File opened for modification C:\Program Files\SelectComplete.pptx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SETLANG.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGMASTHD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGPUNCT.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RECL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0281904.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0297707.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\fontmanager.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRAPH.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21332_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar svchost.exe File opened for modification C:\Program Files\UpdateRead.mht svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB7.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\ModifiedTelespace.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLPROXY.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RSSITEMS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Trek.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099185.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195428.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Midway svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196060.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfigInternal.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR5B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Solstice.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL082.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Wordcnv.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\THOCR.PSP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099195.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OrielMergeFax.Dotx svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Comments.accdt svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Author2XML.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR46F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185800.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-print.xml_hidden svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0296277.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107724.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NAME.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\desktop.ini svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0294991.WMF svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Casual.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18248_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LABELHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00090_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01219_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00390_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\YST9 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDCNCLS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLFLTR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PROGRAM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02051_.WMF svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00255_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWRECC.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBCONV.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01603_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SPACER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN092.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_off.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\SalesReport.xltx svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15022_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01575_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.ES.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libalphamask_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02389_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\CodeFile.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok svchost.exe File opened for modification C:\Program Files\Windows Journal\jnwppr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORM.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14530_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00233_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9 svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18215_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.PH.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR10F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15018_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02085_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.DEV_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\DADSHIRT.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0301050.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR18F.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Moncton svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME26.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01468_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02742G.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrowMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14516_.GIF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21375_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105276.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00911_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ml.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Verve.thmx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BREAK.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14869_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101980.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\DADSHIRT.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\TexturedBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188513.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02749U.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIDEBARVERTBB.DPV svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Amman svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.DEV_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00455_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105360.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00633_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382955.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN110.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\RESUME.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWSTRUCT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7ES.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14792_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107544.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Brunei svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01265U.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewDblClick.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02263_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00834_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Recife svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSO0127.ACL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02845G.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02793_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wake svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Origin.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\OUTDR_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\TECHTOOL.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\ORG97R.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171847.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00670_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10 svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS.HXS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE06049_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar svchost.exe File opened for modification C:\Program Files\MergeJoin.xhtml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_decreaseindent.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanResume.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\IPDSINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPAPERS.INI svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Adobe.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099172.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Sofia svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02742U.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGLINACC.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\amd64\jvm.cfg svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll svchost.exe File created C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME49.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGPUNCT.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EssentialMergeLetter.dotx svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02169_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OFFRHD.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD.DEV_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14529_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF svchost.exe File opened for modification C:\Program Files\Windows Journal\jnwmon.dll svchost.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlcecompact35.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST7MDT svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Cairo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR32F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00806_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00734_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0217872.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02470U.BMP svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR40F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\Notebook03.onepkg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME11.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14801_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN026.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10289_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00242_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01236_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18227_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01268_.GIF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\custom.lua svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\CONFLICT.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECURL.ICO svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Genko_2.jtp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE04050_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00820_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CET svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\RM.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21370_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01561_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.0.2.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7FR.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\resources\1033\Synchronization.rll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.XML svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ta.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSPUB.TLB svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSYUBIN7.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_th.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0299763.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Hardcover.thmx svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SPRNG_01.MID svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Martinique svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.Infopath.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\OUTGOING.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00623_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ProjectStatusReport.potx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02233_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ENVELOPE.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html svchost.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FS3BOX.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Colombo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OriginLetter.Dotx svchost.exe File created C:\Program Files\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\CheckpointSwitch.xps svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis.css svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-TW.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00298_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSStr32.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\InfoPathWelcomeImage.jpg svchost.exe File created C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01395_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME55.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178639.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01130_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CERT.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0301052.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mazatlan svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.DEV_COL.HXT svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\BlackTieLetter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Thule svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107300.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03451_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0222021.WMF svchost.exe File opened for modification C:\Program Files\UndoCompare.vdx svchost.exe File created C:\Program Files\Microsoft Office\Office14\Library\SOLVER\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME15.CSS svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49B.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fa.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115843.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01568_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CERT.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188667.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BANNER.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285780.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDREQL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0304861.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00726_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0215709.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00238_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00261_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02426_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00017_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg svchost.exe File created C:\Program Files\Microsoft Office\Office14\Bibliography\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153047.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PSSKETLG.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Phoenix svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_mmx_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00735_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties svchost.exe File created C:\Program Files\Java\jre7\bin\plugin2\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02522_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341328.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\IntroducingPowerPoint2010.potx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02039_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Maceio svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME52.CSS svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLMAPI32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Generic.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0299587.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107734.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153305.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153516.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GreenTea.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\GMT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN011.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\OneNote\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\ALARM.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0234687.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7es.kic svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\OLJRNLR.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SETLANG_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0293234.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01179J.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\macroprogress.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00126_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLPH.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsMacroTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hiring Requisition - Customized.fdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01658_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105250.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107426.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FLYER.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7ES.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN082.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BIZCARD.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0335112.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Composite.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\HORN.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Issue Tracking.gta svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287018.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185778.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_K_COL.HXK svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107468.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02757U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Country.css svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSLaunch.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN010.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PAPERS.INI svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OWSHLP10.CHM svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessData.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01366_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107328.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\validation.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143753.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java_crw_demo.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\ssv.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01013_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\OLADDR.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN081.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00476_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\RADIO.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll svchost.exe File created C:\Program Files\Java\jre7\lib\ext\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GROOVE.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\STSLIST.CHM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME10.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115856.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099183.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt svchost.exe File created C:\Program Files\Java\jre7\lib\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11 svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0232395.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REC.CFG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02045_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18253_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00685_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.IN.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGNAVBAR.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158477.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188511.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PPCORE.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0285926.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152702.WMF svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01172_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.SG.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187647.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297727.WMF svchost.exe File opened for modification C:\Program Files\FormatUnprotect.mpv2 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\WSS\107.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02134_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Couture.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\MAIN.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\VCTRN_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGREPFRM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.OPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15168_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382939.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nome svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00693_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTITS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0234131.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\BlackTieNewsletter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18203_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\TOOT.WAV svchost.exe File opened for modification C:\Program Files\Windows Journal\en-US\Journal.exe.mui svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0315612.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00531_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE01172_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00914_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLLIBR.DLL svchost.exe File opened for modification C:\Program Files\TestApprove.7z svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0301432.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0216516.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javafx-font.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Students.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\form_edit.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18206_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00417_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-CN.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0318804.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18189_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0237759.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB02229_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10254_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00530_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7fr.kic svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14754_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAClientPkgUI.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200521.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OneNoteSyncPCIntl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.TW.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.security svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\ACCOLK.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAClientPkg.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7EN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15061_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187835.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02617_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106124.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00687_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\OLAPPTR.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187859.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01858_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OneNote\SendToOneNote.gpd svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0235319.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\javafx.properties svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238959.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00494_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\OCEAN_01.MID svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01548_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00557_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL095.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\EXPLODE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00433_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\ACT3R.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageBlank.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayman svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LTHD98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0237228.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PSTPRX32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WPULQT98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignright.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01300_.GIF svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Genko_1.jtp svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zurich svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_nl.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099203.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_iw.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SSGEN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7ES.LEX svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02066_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0293240.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsdt.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\ODBC.SAM svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\La_Paz svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\BlackTieResume.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0293832.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yakutat svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285792.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0205582.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0186346.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOUC.EXE svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\London svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ENV11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\BOMB.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONINTL.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Median.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\MP00646_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\SignedManagedObjects.cer svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\GostName.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0240695.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGLOGO.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01040_.WMF svchost.exe File created C:\Program Files (x86)\MSBuild\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CATWIZ.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_pressed.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0234000.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00388_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\MedianLetter.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00668_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RECS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00788_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EntityPickerIntl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\WANS.NET.XML svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21340_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsound.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUDIOSEARCHMAIN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0283209.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Premium.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14793_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PPTIRM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGPICCAP.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0293570.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107188.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UTC svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\how_to_back_files.html svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239079.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.SE.XML svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATE.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CoolType.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\MENU.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR15F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0251301.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\PLUS.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONELEV.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21310_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MAPISHELLR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUP.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EXLIRM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15134_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152876.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02093_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SCHOL_02.MID svchost.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02287_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SCNPST32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.JS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01607U.BMP svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\AWARDHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086478.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\Library\Analysis\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\psfont.properties.ja svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14882_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LINEACT.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_underline.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188679.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02736U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00452_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\MedianResume.Dotx svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14752_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00114_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14755_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR10F.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\eula.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBARBLL.DPV svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\TEAROFF.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\EmptyDatabase.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099175.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Accra svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0240291.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LISTBOX.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00563_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287644.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4 svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01244_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Chita svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL026.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18190_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199423.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239973.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\POST.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OEMPRINT.CAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18200_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Almaty svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099196.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL109.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME35.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0237336.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\ACT3.SAM svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107280.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7tk.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03236_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\accessibility.properties svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14768_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099173.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382931.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00411_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL044.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10256_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0232797.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\Presentation Designs\Maple.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LTHD11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0300862.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02263_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BROCHURE.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00419_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00543_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\GRIPMASK.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152708.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\FAX\MedianFax.Dotx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15133_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171685.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\currency.data svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199429.WMF svchost.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Events.accdt svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Matamoros svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\QUIKPUBS.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SETLANG_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0301252.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143752.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103262.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\trusted.libraries svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\COIN.WAV svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\oisctrl.dll svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0241077.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18196_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107042.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EssentialReport.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\MedianMergeFax.Dotx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CERT98SP.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Solstice.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00687_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src svchost.exe File created C:\Program Files\Java\jre7\lib\amd64\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ospintl.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OrielResume.Dotx svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01563_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\MMSS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\FAXEXT.ECF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT_COL.HXT svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageStyle.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\MSOSEC.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR45F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\background.gif svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21297_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10335_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Issues.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\PINELUMB.HTM svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties svchost.exe File opened for modification C:\Program Files\DisableAssert.dotx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe svchost.exe File created C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\BCSRuntimeRes.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43F.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHigh.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21330_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239951.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME30.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195260.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Bibliography\Style\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02957_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR23F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02791_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOCFU.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBLINK.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ADD.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewSelectionChanged.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14583_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18230_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIconMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21324_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10299_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14833_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18202_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanMergeFax.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02749G.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montevideo svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Media.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107254.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OARTCONV.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBORDER.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow.css svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_kn.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238333.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Status.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterToolTemplates.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SlateBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DISTLSTS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\STSLISTI.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02071U.BMP svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUB6INTL.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143746.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099171.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198377.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Lima svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152590.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NAVBRPH1.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10255_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Gaza svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152570.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Beige.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSCOL11.INF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRINTL32.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Traditional.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR21F.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00052_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UCT svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\libvlc.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIconsMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN095.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME51.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02293_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185828.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CSS7DATA000C.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VVIEWDWG.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL010.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.HOL svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EMABLT32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda svchost.exe File opened for modification C:\Program Files\ResolveExport.vstx svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Default.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\UmOutlookStrings.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDRESP.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15135_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SIGNL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200377.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_AutoMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0158007.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0302953.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\RECYCLE.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE.MANIFEST svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LINE.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME24.CSS svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ClassicPhotoAlbum.potx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR17F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR30F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18241_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01751_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rainy_River svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\CLVWINTL.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE svchost.exe File created C:\Program Files\Java\jre7\lib\cmm\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0090070.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0289430.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDREST.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18251_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB2B.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OISINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00010_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0241043.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02758U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EMSMDB32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099174.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00513_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101860.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WORDREP.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECURS.ICO svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Barbados svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287408.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382967.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.xml svchost.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02448_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART12.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0318810.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\BUZZ.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ExecutiveResume.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02296_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14532_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ContactPicker.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AU.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.BR.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01064_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00217_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKACCS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0293238.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0295241.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105846.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BRCHUR98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51F.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\sound.properties svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\BloodPressureTracker.xltx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21390_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\MDIParent.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD.DEV_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.policy svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayenne svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\meta-index svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBREF.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01182_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Niue svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21505_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL096.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART1.BDR svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\PST8PDT svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RESEND.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BS2BARB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZUSR12.ACCDU svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01240_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\COPYRIGHT svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN001.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21495_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\plugins.dat svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00391_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\j2pcsc.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE01661_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157191.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\WHOOSH.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\SectionHeading.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00998_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ENVHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0232803.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00232_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR43F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\SOLVER\SOLVER32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWLAY32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02124_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nipigon svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14871_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL111.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImagesMask16x16.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSGR3EN.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44F.GIF svchost.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183174.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00330_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01295_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MIMEDIR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00483_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\EMAIL.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\Analysis\ATPVBAEN.XLAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME50.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387604.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Makassar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Minsk svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\OLTASKR.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Users.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00286_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00555_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OIS_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Angles.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip svchost.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKDEC.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151047.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382944.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBPAGE.XML svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OMSINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.UK.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10302_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18244_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00157_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSSync.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115842.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341499.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00097_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME02.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00938_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21422_.GIF svchost.exe File created C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB1B.BDR svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00458_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN048.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ERROR.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21512_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Chagos svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\AIR98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN102.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR1F.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099205.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12 svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\83.0.4103.106\83.0.4103.106_chrome_installer.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02265_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10264_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15272_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGAD.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QRYINT32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18221_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099166.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01734_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jawt.dll svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21520_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSRuntime.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Median.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Opulent.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01585_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02886_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00013_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\OliveGreen.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Newsprint.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105376.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cancun svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MX.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESPL.ICO svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\GWE.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0241781.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Start End Dates.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7cm_fr.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00629_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01657_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CST6CDT svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dili svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00828_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0300840.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01421_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00014_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00683_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21504_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKACCL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\otkloadr_x64.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21304_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115835.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0304405.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REPORT.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESTS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00934_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105232.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00364_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR14F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281008.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Stock Quotes.iqy svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14580_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01213K.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00241_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\rt.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL087.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\EXITEML.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00096_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18198_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7tkjp.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18226_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Foundry.thmx svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\CAMERA.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSOUC_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB10.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\CollectSignatures_Init.xsn svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152882.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_decreaseindent.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01638_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102002.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL002.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0075478.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\sunec.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\STORYBB.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDCNCL.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_06.MID svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART5.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153087.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Marketing Projects.accdt svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSACC.OLB svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\PublicFunctions.js svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0157763.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Maldives svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086384.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0174635.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01181_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.JP.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10300_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\local_policy.jar svchost.exe File opened for modification C:\Program Files\LockCompress.dib svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PRTF9.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BAN98.POC svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01565_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CDLMSO.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWRECS.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME32.CSS svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0301076.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00268_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01246_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\XLCALL32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Person.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01123_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLLEX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Grid.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105496.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400003.PNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02270_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTFORM.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\INFOPATH.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0305257.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_hyperlink.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00077_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01682_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSCOL11.PPD svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Verve.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01169_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239941.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN089.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18224_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OIS.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\DESKSAM.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00197_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341439.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\calendars.properties svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FLY98SP.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102594.WMF svchost.exe File created C:\Program Files\Java\jre7\lib\fonts\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECURE.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01744_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107750.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10253_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OMSMAIN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR1B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGACCBAR.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\GostTitle.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONGuide.onepkg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nassau svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\El_Salvador svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0284916.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0285444.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6 svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR24F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18205_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_ON.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLMIME.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL106.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0321179.JPG svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107132.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02423_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESPS.ICO svchost.exe File created C:\Program Files\VideoLAN\VLC\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Faculty.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_underline.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00308_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART3.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00910_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\WORDIRMV.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL110.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\DELETE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21306_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00014_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02269_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\POSTCARD.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ACTIP10.HLP svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14997_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_el.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME16.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01191_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02041_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107350.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\RADAR.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103058.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02862_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03466_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignright.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\JFONT.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTITL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18180_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341654.JPG svchost.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\83.0.4103.106\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0293800.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\OFFISUPP.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABON.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONENOTE.HXS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN002.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\AdjacencyMergeLetter.dotx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Edmonton svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152432.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200611.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02369_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0212661.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\ORG97.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OMSINTL.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfoInternal.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0251925.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01560_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02028_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01491_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0240175.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0337280.JPG svchost.exe File opened for modification C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Whitehorse svchost.exe File created C:\Program Files (x86)\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOff.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.MMW svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187829.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00272_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01239_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EET svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Civic.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099192.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01157_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OMML2MML.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ContactPickerIntl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00799_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00837_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL svchost.exe File created C:\Program Files (x86)\Google\Temp\GUM2396.tmp\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18239_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199661.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\zipfs.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay.css svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\1033\MSGR3EN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR00.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152690.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0301418.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WITHCOMP.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10298_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03379I.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\LICENSE svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PRRT.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\HEADINGBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.JS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Earthy.css svchost.exe File created C:\Program Files\Microsoft Office\Document Themes 14\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Pushpin.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182946.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03041I.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0212219.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105230.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnWD.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CALENDAR.DPV svchost.exe File opened for modification C:\Program Files\BackupRegister.ps1xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR.HXS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBBTN.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FALL_01.MID svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00118_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102984.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CSS7DATA000A.DLL svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PICSTYLES.DPV svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\psfontj2d.properties svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWS.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR19F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OIS_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107358.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178523.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FRENCH.LNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152628.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02407_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdate.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\DLGSETP.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.DEV_K_COL.HXK svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Text.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7ES.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR21F.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13 svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OriginResume.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0212299.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309920.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Managua svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\FONTSCHM.INI svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00792_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB4.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107502.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Budapest svchost.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceoledb35.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03380I.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01777_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086426.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00795_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKDECL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\EMAIL.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml svchost.exe File opened for modification C:\Program Files\Windows Journal\NBMapTIP.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\OFFISUPP.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ExecutiveNewsletter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCDDSF.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN058.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SETLANG_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199755.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0240189.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02388_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLACCT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0093905.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SEQCHK10.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00669_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02453_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00720_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00132_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\RESP98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessData.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00608_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01296_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Sort\TITLE.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00095_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBCOLOR.SCM svchost.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200279.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLLIBR.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Maroon.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR20F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Teal.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105282.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0241041.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\Microsoft.Synchronization.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BANNER.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN054.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE01191_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ADD.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01163_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152890.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157831.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01041_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\RSPMECH.POC svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0286034.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PPSLAX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR31F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02413_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Darwin svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Phone.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187815.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0232795.WMF svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\Access\Part\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GFX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\HEADING.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7wre_en.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14800_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0235241.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105526.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00784_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02424_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm svchost.exe File opened for modification C:\Program Files\FindComplete.potm svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BULLETS.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105388.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar svchost.exe File created C:\Program Files (x86)\Google\Update\Install\{5DF2DCA9-BD54-4513-9B32-2C551D72B961}\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR51F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02748G.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_id.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WHITEBOX.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL092.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02398U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MOR6INT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01361_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02278_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02755U.BMP svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\GIFT.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101861.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PS10TARG.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\RTF_BOLD.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\ARROW.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR41F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\BREEZE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\VVIEWRES.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME36.CSS svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\OutSyncPC.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\OLNOTE.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00018_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00212_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02198_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OART.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OISAPP.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0297551.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\BG_ADOBE.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\STOPICON.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\PROOF\1036\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE01160_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0304371.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01749_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\MARQUEE.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Xlate_Init.xsn svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21518_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LTHDHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\MANUAL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14565_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.Xml.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\UnformattedNumeric.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Equity.xml svchost.exe File opened for modification C:\Program Files\SetStep.asp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CGMIMP32.HLP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15171_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15021_.GIF svchost.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NL7Lexicons0011.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01297_.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OIMG.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01848_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\STORYBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR22F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02386_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PG_INDEX.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0291984.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hi.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0212953.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02024_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00681_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAProjectUI.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\ACTIVITL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151045.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VVIEWER.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONTAB32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01356_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\STUBBY1.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\CONTACTL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21294_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099159.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02451_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESTL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105320.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00523_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXT svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14866_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297757.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00810_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ADRESPEL.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PPINTL.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02750U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00943_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21305_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01015_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00221_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar svchost.exe File opened for modification C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\WSS_DocLib.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\PublicFunctions.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00531L.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BZCD98SP.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\NL.ROGERS.COM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FLYER11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONINTL.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Median.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239955.WMF svchost.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0332268.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18191_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00638_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OOFL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382925.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0089945.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PSRCHSRN.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\STSUPLD.INTL.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FOLDPROJ.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01852_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02431_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javaws.policy svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_vi.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CATALOG.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02412K.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341448.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\XML Files\builtincontrolsschema.xsd svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FORM.ICO svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\content-types.properties svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME18.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099179.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099199.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf svchost.exe File opened for modification C:\Program Files\Java\jre7\Welcome.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKACC.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00414_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CSS7DATA0009.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR26F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0295069.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Atikokan svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ExecutiveMergeLetter.dotx svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\FAX\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTL.ICO svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7 svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115868.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Classic.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02088_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\EXITEMS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REMOTES.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB11.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosecolor.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\APPTS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21435_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN065.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BZCARD11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\PersonalMonthlyBudget.xltx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Winnipeg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSQRY32.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PSRCHPHN.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IPIRM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00049_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.PL.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.DEV_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187817.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00058_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00394_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB5A.BDR svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_SlateBlue.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200183.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Fortaleza svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\WHOOSH.WAV svchost.exe File created C:\Program Files\Java\jre7\lib\deploy\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\To_Do_List.jtp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01196_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0241019.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\macroprogress.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0212701.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Major Indicies.iqy svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\XML Files\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01146_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099198.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281640.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18220_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CNFNOT32.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGTEAR.DPV svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REMOTE.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02578_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lt.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0228823.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PROGRAM.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14828_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01149_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107150.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belize svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107658.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387337.JPG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15023_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03795_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Doc.css svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Sort\YEAR.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00482_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15302_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0136865.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME37.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0215210.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18235_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185790.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\CERTINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199609.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL089.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_increaseindent.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01793_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21548_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00780L.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_03.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239611.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01164_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Creston svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10336_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105294.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\cacerts svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107742.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02265_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ru.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00234_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02009_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\DELIMR.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.Infopath.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0297185.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CARBN_01.MID svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\README.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RCLRPT.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR16F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00586_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWS.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Aspect.thmx svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Macau svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297269.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\MP00132_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SIGNS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107154.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Taipei svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Issues.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15034_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCAL.DPV svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTORE_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSAIN.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME39.CSS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287643.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Moscow svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ACCTBOX.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.HXS svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIconMask.bmp svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\management.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PICCAP98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\excelcnv.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238927.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02754U.BMP svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\validation.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00512_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01368_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosefont.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\WWLIB.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\XIMAGE3B.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ERROR.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02106_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0313974.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSOUC.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SETLANG.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Austin.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIconsMask.bmp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\GrooveFormsMetaData.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL011.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GR8GALRY.GRA svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21338_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OriginReport.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RSWOP.ICM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_am.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FLAP.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DOTS.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.DEV_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00526_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Hobart svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02077_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0285360.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107290.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSUPLD.DLL svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ReviewRouting_Review.xsn svchost.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwgl_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14655_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18207_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_OliveGreen.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NL7Data0011.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Generic.css svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Seyes.jtp svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin svchost.exe File opened for modification C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WWINTL.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Reunion svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf svchost.exe File created C:\Program Files\Microsoft Office\Office14\1036\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196110.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0233512.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGPICCAP.XML svchost.exe File opened for modification C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\Synchronization.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL054.XML svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02368_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02398_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\PAGESIZE\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01235U.BMP svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01242_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\Access\WSS\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.FR.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\MEDIA\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts.css svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0280468.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281632.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL090.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OFFOWC.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\LOCALDV.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montreal svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABMASK.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Country.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14531_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00513_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR29F.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14983_.GIF svchost.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239935.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7ES.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0293844.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Perspective.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART7.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0299611.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Data1.cab svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01044_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21308_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\MLA.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\FAX\OrielFax.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR16F.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18187_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309705.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADVTEL.DIC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\POSTCD98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198113.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01141_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\oisctrl.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0279644.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0292270.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PTXT9.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_disable.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21328_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\CASHREG.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\INDOMAIN.ICO svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105414.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR38F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0384888.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PPTICO.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00246_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CONTACT.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21336_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\NUMERIC.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SETLANG_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSIDEBRV.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBPAGE.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONENOTE_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml svchost.exe File opened for modification C:\Program Files\AssertUse.htm svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\AUTOSHAP.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART9.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18184_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Resolute svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ACCVDTUI.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ENVELOPR.DLL.IDX_DLL svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN103.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EXLIRMV.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\management-agent.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\BTINTERNET.NET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDCNCLL.ICO svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107266.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\NVBELL.NET.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKREQ.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\ODBCR.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Apex.thmx svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_mr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKREQL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105502.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\mlib_image.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ApothecaryMergeLetter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\PABR.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WWINTL.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382836.JPG svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB3A.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14691_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00042_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099186.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341475.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Module.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\OLAPPT.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00396_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mspub.exe.manifest svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18254_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00640_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01357_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Equity.xml svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099178.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01354_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL058.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115844.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105292.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02125_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199727.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\TOOLICON.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\AdjacencyReport.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\NOTES.ICO svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AboutBox.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15156_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0232393.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tunis svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7EN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\glib-lite.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL075.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\subscription.xsd svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\REPTWIZ.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21427_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14981_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRdIF.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Inuvik svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\MUSIC_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\NOTE.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7FR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IPIRMV.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185776.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00459_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00917_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105600.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGNAVBAR.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME13.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00915_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199465.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\msaccess.exe.manifest svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_OFF.GIF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN01165_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115841.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0292272.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115864.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00807_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02437_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB9.BDR svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00019_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\OutDomain.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING1.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Palau svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGAD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0386764.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18234_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSAutogen.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188519.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00233_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SegoeChess.ttf svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\MP00021_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01293_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\RE00006_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21448_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\how_to_back_files.html svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\SEAMARBL.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.CN.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL103.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDCAT.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\PMAILEXT.ECF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\splash.gif svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Paramaribo svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\MedianReport.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00235_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107450.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\COMPUTER.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\messageboxerror.ico svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02276_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\net.properties svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01065_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152704.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0292152.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Riga svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\HEADINGBB.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0318448.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00942_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\TextFile.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATH.HXS svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14844_.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECRECS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\OLMAILR.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00505_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONWordAddin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10290_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-PT.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00170_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid_over.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7wre_fr.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0217698.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143748.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02262_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Madrid svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\net.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18216_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\AcroRead.msi svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0098497.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107516.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Monterrey svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0149627.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0197983.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OCRHC.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\INCOMING.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107458.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PPTIRMV.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\PAWPRINT.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\RESUME.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02040U.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MAPIPH.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105912.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Beirut svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03731_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnPPT.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\CHEVRON.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR41F.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Apia svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\splashscreen.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Black Tie.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Paper.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107302.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Hermosillo svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SHARING.CFG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PS2SWOOS.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ApothecaryLetter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NL7MODELS000A.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\TexturedBlue.css svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Opulent.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0215070.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OneNote\SendToOneNOteFilter.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285796.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\WSS\1100.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SlateBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14795_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Adjacency.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287019.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Discussion.gta svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Essential.eftx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0202045.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0240157.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01221K.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00783_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\skins\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME03.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageSlice.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00726_.WMF svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Music.jtp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Manuscript.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\OliveGreen.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\JNGLE_01.MID svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OrielMergeLetter.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OriginMergeFax.Dotx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuching svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185806.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0294989.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WITHCOMP.DPV svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWORIENT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0240719.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198372.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02062U.BMP svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\APPLAUSE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_LightSpirit.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02158_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MY.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15073_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0197979.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187837.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME08.CSS svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\msvcr100.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107446.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199475.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200383.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe svchost.exe File created C:\Program Files (x86)\Microsoft Office\Office14\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EssentialResume.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Tasks.accdt svchost.exe File created C:\Program Files\Microsoft Office\Office14\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14867_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00397_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBSBR.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\fxplugins.dll svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_uk.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHighMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153093.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MORPH9.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLN.XLS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105368.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152622.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\how_to_back_files.html svchost.exe File created C:\Program Files\Java\jre7\lib\jfr\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\CNFNOT.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145879.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14711_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152606.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02039U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01745_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS.DEV.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR6B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00320_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\RPLBRF35.CHM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00414_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02071_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152594.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santarem svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSPPT.OLB svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\JUNGLE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\SPLASH.WAV svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javafx-iio.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105234.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18242_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02267_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Damascus svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0213449.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Country.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBSBR.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5 svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ContemporaryPhotoAlbum.potx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341344.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME12.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.DPV svchost.exe File created C:\Program Files\Java\jre7\lib\zi\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR39F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18194_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRAPH_COL.HXT svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02055_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02055_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBBTN.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Maroon.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE05869_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_da.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02361_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387578.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll svchost.exe File created C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\resources\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7en.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7wre_es.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\StatusOnline.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0302827.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00256_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143750.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200467.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0324704.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239057.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01253_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\t2k.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\MSOSEC.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\CNFRES.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151073.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SHOW_01.MID svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\INFOMAIL.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\SUBMIT.JS svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\QP.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_it.properties svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR37F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\CAN.WAV svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\EMAILMOD.POC svchost.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceqp35.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\CLICK.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21307_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200163.WMF svchost.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SUBMIT.JS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\msproof7.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115855.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00350_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00172_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine_64.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWS98.POC svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\1033\OFFICE10.MML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART6.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\JUDGESCH.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15072_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0230558.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NAMECONTROLSERVER.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SAEXT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\STSLIST.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01152_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dt_shmem.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0233070.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE06450_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_pressed.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185796.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0149481.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_de.properties svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sw.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CHECKER.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Slipstream.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api svchost.exe File created C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Havana svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14528_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01176_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\SBCGLOBAL.NET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0234001.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185780.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03339_.WMF svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Shorthand.jtp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL086.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME22.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0212957.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01742_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01154_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14692_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099170.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178459.JPG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10301_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18228_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382961.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382938.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Samara svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Category.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\AD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FLYER98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RESENDL.ICO svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Athens svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24Images.jpg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OOFTMPL.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02740U.BMP svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16ImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14985_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107708.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152600.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MLSHEXT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR13F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Flow.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198494.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterNotificationDescriptors.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libmarq_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BORDERBB.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\STUBBY2.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0185604.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Monaco svchost.exe File opened for modification C:\Program Files\CheckpointResize.midi svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\GB.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0215710.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE05710_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02464_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BORDERBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185842.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONENOTEIRM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183574.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\SNET.NET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10266_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105280.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18245_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR45B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14654_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanLetter.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\MMSL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0157995.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105272.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0148757.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PSRCHLEX.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32B.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME38.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00190_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0217262.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Currie svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Eirunepe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\MMHMM.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10297_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151061.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OSPP.VBS svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Custom.propdesc svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrow.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01566_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0230876.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CALSO11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0233992.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21323_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR42F.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.THD svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7ES.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153508.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\INFOML.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02439_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382927.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR17F.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts2.css svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB5B.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\gfserrortogroove.ico svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\PROOF\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0149887.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02450_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fil.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\powerpnt.exe.manifest svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo svchost.exe File created C:\Program Files\Microsoft Office\Office14\FORMS\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR22F.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\hprof.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15132_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0300912.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14677_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196364.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\REMINDER.WAV svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jpeg.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGZIPC.XML svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR26F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198234.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115865.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18192_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01236U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00932_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONENOTEMANAGED.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL048.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185818.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0296288.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0296279.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSClient.Msg.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN111.XML svchost.exe File opened for modification C:\Program Files\ApproveClose.aif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ASCIIENG.LNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Document.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02120_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javafx.policy svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ENVELOPE.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14533_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\IPML.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02443_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18204_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SUBMIT.JS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OISGRAPH.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\prism-d3d.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif svchost.exe File created C:\Program Files\Java\jre7\bin\server\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\MedianMergeLetter.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18222_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\common.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN096.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15058_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGPQUOT.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBHD.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IE.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183198.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\OLR.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00299_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\ONLINE.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\StatusAway.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01434_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SELFCERT.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSRTEDIT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00159_.WMF svchost.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_TexturedBlue.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Essential.thmx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SPANISH.LNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195320.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR15F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SlateBlue.css svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14578_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Track Issues.fdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART11.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1036\MSO.ACL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_07.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02048_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ENVELOPE.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101864.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00018_.WMF svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME21.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107138.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR28F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107718.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Projects.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck.css svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15155_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\psuser.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341534.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02446_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Juneau svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNoteSyncPC.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME01.CSS svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL107.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\how_to_back_files.html svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199307.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00289_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig svchost.exe File created C:\Program Files\Microsoft Office\Office14\SAMPLES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePage.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086428.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099167.JPG svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_et.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL102.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Author2String.XSL svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\DataServices\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18193_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Thatch.thmx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Process Library.fdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00478_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-BR.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID svchost.exe File opened for modification C:\Program Files\Windows Journal\MSPVWCTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\utilityfunctions.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00466_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00768_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Anchorage svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\installer.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14710_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14757_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jdwp.dll svchost.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EquityReport.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01639_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GRAPH.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMaskSmall.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR12F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME31.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0305493.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.InfoPath.FormControl.dll svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKUPD.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105266.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Adjacency.eftx svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EquityMergeFax.Dotx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Dawson svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Maputo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0292020.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Equity.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SCANPST.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MYSL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGZIP.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR36F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14581_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00454_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Araguaina svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7ES.DLL svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107282.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PS9CRNRH.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTAREA.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7db.kic svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18181_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02214_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGDOTS.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090777.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02373_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107090.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0228959.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00194_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157177.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIDEBARVERTBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_center.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0292982.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLFLTR.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\CHICAGO.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\FAX\EquityFax.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGMAIN.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL022.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_on.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02740G.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ExecutiveLetter.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SMSS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST5EDT svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IMPMAIL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBTRAP.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\INVITE11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0229385.WMF svchost.exe File opened for modification C:\Program Files (x86)\desktop.ini svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152610.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF svchost.exe File opened for modification C:\Program Files\BlockEnter.vsw svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382965.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\verify.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR51B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\SEAMARBL.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00559_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME14.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107182.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESNL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0324694.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01747_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip svchost.exe File created C:\Program Files\Microsoft Office\Office14\3082\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00390_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03257_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IEContentService.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18238_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\ContactSelector.ico svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\management\snmp.acl.template svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\HICCUP.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\OLTASK.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02270_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239965.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\PINELUMB.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\STORYVERTBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCDDS.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OneNote\SendToOneNote.ini svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\SHOVEL.WAV svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\server\Xusage.txt svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\validation.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB8.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN109.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\PublicFunctions.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14514_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18185_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152602.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Flow.eftx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONENOTE_COL.HXT svchost.exe File created C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086432.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099151.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107344.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WHIRL1.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tirane svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0285410.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18225_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.XML svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REPORTS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107316.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPSLAX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10268_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0186362.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14595_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUB6INTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00489_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PSWAVY.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Manaus svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01750_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00177_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0251871.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SLINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01069_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02009_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03459_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB2A.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\APPTL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115876.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107528.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Blog.dotx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7en.kic svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0216858.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297725.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CALENDAR.XML svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Curacao svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GreenTea.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Bibliography\BIBFORM.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hovd svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Graph.exe.manifest svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0148309.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\WORDICON.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBCALSO.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Technic.thmx svchost.exe File opened for modification C:\Program Files\SplitSwitch.bat svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NAVBRPH2.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099146.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\PASSWORD.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153299.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187849.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01470_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03241_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\ELPHRG01.WAV svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jfxrt.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_choosecolor.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTORE_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL105.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\PAB.SAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152556.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287020.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02223U.BMP svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN108.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21327_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IPEDITOR.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr.jar svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02028K.JPG svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ko.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21527_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14870_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099163.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152626.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIGN.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\ACTIVITS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14693_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105390.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR12F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153095.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0292286.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01701_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\INTLDATE.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR13F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0278882.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01152_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02371_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02253_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OCLTINT.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18257_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBWZINT.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099184.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0292278.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\SessionMember.ico svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0386270.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR11F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198102.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\logging.properties svchost.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\AdjacencyResume.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AR.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\IPOLKINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TAIL.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIconMask.bmp svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Antigua svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Caracas svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB01741L.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EquityResume.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.dub svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309567.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382968.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AssemblyInfoInternal.zip svchost.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hardware Tracker.fdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF svchost.exe File created C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187863.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWDWG.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SPACE_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\SNEEZE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR5F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00779_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Detroit svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NL7Models0011.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\DELETE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0297749.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Casual.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02091_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00231_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\GIGGLE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.DEV_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME27.CSS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21321_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152560.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00486_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\STRBRST.POC svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Adak svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\excel.exe.manifest svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SUBMIT.JS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\ResizeRestore.reg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090087.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01572_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Cocos svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR46B.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02097_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT svchost.exe File created C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00712_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCDDSLM.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216570.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmod_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NAVBAR11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\WSS.ICO svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01805_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00704_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\TRANSMRR.DLL svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bn.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGREPFRM.DPV svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Clarity.thmx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.DE.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guatemala svchost.exe File created C:\Program Files\Microsoft Office\Office14\QUERIES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7F.GIF svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0205466.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382954.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00444_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePage.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0183290.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086420.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL020.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL104.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACEDAO.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0299125.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\1033\OLNOTER.FAE svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\decora-sse.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Training.potx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21322_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar svchost.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Groove Starter Template.xsn svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_on.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EntityDataHandler.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DOC.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLWVW.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287417.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00452_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00208_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WHIRL2.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01304G.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\form_edit.js svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8 svchost.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\IPM.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115839.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187851.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\misc.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101866.BMP svchost.exe File opened for modification C:\Program Files\WatchOptimize.lock svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santiago svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS.DEV_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101862.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\VBAOWS10.CHM svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MLCFG32.CPL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXC svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01838_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14996_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196358.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14515_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00413_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBHOME.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0313970.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ACCSBAR.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00352_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0164153.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382952.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BIZCARD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Adobe.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200151.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0285750.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01148_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\GREETING.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN107.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\INFOMS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0313965.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00688_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_over.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\CONTACTS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01473_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\blacklist svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216612.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Malta svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PNCTUATE.POC svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg svchost.exe File created C:\Program Files\Microsoft Office\Office14\Bibliography\Sort\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME23.CSS svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Berlin svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.dtd svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309902.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right_over.gif svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF svchost.exe File opened for modification C:\Program Files\DebugShow.mpv2 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\IPMS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUB6INTL.REST.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Oriel.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153518.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BS4BOXES.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\bdcmetadata.xsd svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195342.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00257_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Priority.accft svchost.exe File opened for modification C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382942.JPG svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE05665_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01299_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME44.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21329_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02441_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00898_.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0234657.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01636_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01954_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Denver svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00479_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12 svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00453_.WMF svchost.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati svchost.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.Xml.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIDBAR98.POC svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCICONS.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IT.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216540.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BS53BOXS.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14845_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14832_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Address.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00211_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SplashScreen.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21320_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Hardcover.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107262.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL027.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02413_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SLERROR.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153089.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00095_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00222_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02252_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\JUDGESCH.HTM svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00965_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\XLICONS.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBHD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SMIMES.CFG svchost.exe File created C:\Program Files (x86)\Google\Update\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PRRTINST.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSAEXP30.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OMSXP32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageScript.js svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMEEXT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART15.BDR svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow.css svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanReport.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107130.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153307.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dt_socket.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\glass.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0234266.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESNS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01291_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02756U.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01628_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Halifax svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar svchost.exe File opened for modification C:\Program Files\UnblockUse.temp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OrielReport.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00935_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FEZIP.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105520.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0089992.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107748.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02736G.GIF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\how_to_back_files.html svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\how_to_back_files.html svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0298897.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Module.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIGN.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWS11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\LASER.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00736_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18252_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\WidescreenPresentation.potx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOUTL.OLB svchost.exe File created C:\Program Files\Microsoft Office\Office14\PUBBA\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\messageboxalert.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Earthy.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Apex.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0285698.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00333_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21319_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00204_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14538_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239953.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\menu_arrow.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Xlate_Complete.xsn svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0090386.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Metlakatla svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GKPowerPoint.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00057_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ENV98SP.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PSRETRO.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115867.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PULQOT98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01253_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102762.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00435_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0172035.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198022.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01472_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00485_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18250_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGACCBOX.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00760L.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VPREVIEW.EXE svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\classlist svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\gfserrorfromgroove.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195254.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099200.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Black Tie.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Adjacency.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199483.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mahe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\COUPLER.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_es.properties svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGATNGET.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\QuizShow.potx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLKIRMV.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7EN.LEX svchost.exe File created C:\Program Files\Microsoft Office\Office14\PROOF\3082\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\UTILITY.ACCDA svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XMLSDK5.CHM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REMOTEL.ICO svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts2.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01631_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\AdjacencyLetter.dotx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\XML Files\grvschema.xsd svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left_over.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLWVW.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\meta-index svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400001.PNG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Regina svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\LATIN1.SHP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SketchPadTestSchema.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGACCBAR.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN105.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.NZ.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0216724.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLPERF.H svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME19.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105348.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\POSTIT.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0384895.JPG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187861.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\3082\MSO.ACL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Office Word 2003 Look.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107482.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00941_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSQRY32.CHM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101865.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281243.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\plugin.jar svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\gstreamer-lite.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN022.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00166_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21434_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099194.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\OnLineBusy.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\macroprogress.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115836.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00723_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SOA.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285820.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287024.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME45.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_italic.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0214934.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_05.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03470_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\INFOPATH_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0221903.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00445_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01332U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03012U.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\STSUCRES.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\nio.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\reflow.api svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143745.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSRuntimeUI.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN075.XML svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONPPTAddin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\LAUNCH.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\SpaceSelector.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21311_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01239K.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ro.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SEARCH.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\UserControl.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.VN.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0172193.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341561.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Memo.jtp svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0241773.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.Adapter.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_OFF.GIF svchost.exe File created C:\Program Files\Microsoft Office\Office14\BORDERS\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107364.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\abcpy.ini svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_te.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mset7ge.kic svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200289.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01245_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCOUPON.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRINTL32.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02262_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0286068.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0186364.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00538_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\CNFNOT.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Horizon.eftx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\PYCC.pf svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01330_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AccessWeb\SERVWRAP.ASP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OFFXML.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\OOFS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR3B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0292248.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIGN98.POC svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185774.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\XOCR3.PSP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02790_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01066_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.DEV.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Elemental.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01329_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143744.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152568.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199469.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL012.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\CONVERT\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ApothecaryResume.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH00780U.BMP svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00382_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18199_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107730.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00494_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBORDER.XML svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART10.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00178_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\profile.jfc svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_on.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285462.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSODCW.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297229.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Oriel.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DVDHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME17.CSS svchost.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187921.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0282932.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Tags.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LABEL.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00389_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21299_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8F.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_it.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Trek.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00532_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Pitchbook.potx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01193_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0195384.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\BillingStatement.xltx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTBOX.JPG svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107492.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE_COL.HXC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0304853.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3 svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIcons.jpg svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\APA.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00391_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageStyle.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hiring Requisition.fdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14769_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216153.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00046_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belem svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\header.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\RES98.POC svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0199303.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01161_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02750G.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03513_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00168_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00671_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGLINACC.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0233018.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXPTOOWS.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115875.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18218_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SOCIALPROVIDER.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Pushpin.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\OL.SAM svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baku svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en-GB.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR39F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0250997.WMF svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\how_to_back_files.html svchost.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107342.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo svchost.exe File opened for modification C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\FeedSync.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4B.GIF svchost.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0175361.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART14.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONENOTE_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400005.PNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01840_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\OnLineIdle.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ONINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107722.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00453_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FORM98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\MAIL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15273_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ReviewRouting_Init.xsn svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18217_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGTOC.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\SUCTION.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\POST98SP.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10263_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek svchost.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00297_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02384_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18209_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR19F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15276_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Perth svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\TRANSMGR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yellowknife svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00006_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2iexp.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0150150.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\VelvetRose.css svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MML2OMML.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0299171.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090089.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03331_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSO.ACL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21309_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\HST svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107488.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\GIFT.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSGR3FR.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\VOLTAGE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF svchost.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185798.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\TYPE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\REFEDIT.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\CONVERT\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18212_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285808.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CharSetTable.chr svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\COUPON.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00068_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02794_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18197_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00086_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02753U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\MENU.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\LightSpirit.css svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\kcms.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGDOTS.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH00601G.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099158.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ENV98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLLIBR.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.DEV.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199549.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guyana svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_de.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0195534.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21423_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Paper.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198021.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200189.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cuiaba svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00454_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00833_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLMACRO.CHM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00346_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198020.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART8.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SMIMEE.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EAWFINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OneNote\SendtoOneNoteFilter.gpd svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bg.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WhiteboxMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\POLICIES.FDT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0211981.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14790_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00184_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00403_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107500.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0233665.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\SPACER.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89 svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\OFFICE10.MMW svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SOCIALCONNECTORRES.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\mscss7es.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01179_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE05870_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BRCH98SP.POC svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sk.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02897J.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105412.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195788.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0250504.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\New_York svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152696.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01035U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDREQS.ICO svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\APPT.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00074_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239975.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWER.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OneNote\SendToOneNoteUI.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_hyperlink.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageSmall.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0313896.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CATALOG.XML svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME41.CSS svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HTECH_01.MID svchost.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\sRGB.pf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Urban.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml svchost.exe File created C:\Program Files\Java\jre7\lib\management\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0215086.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PSSKETSM.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00916_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\LoanAmortization.xltx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FOLDPROJ.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15169_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Slipstream.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0291794.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EXSEC32.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TaxonomyControl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGACCBOX.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL077.XML svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR40F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199036.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PAPER_01.MID svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR25F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153302.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR27F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02748U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGATNGET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10307_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00798_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\St_Johns svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\Whistling.wav svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14984_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00345_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\FAX\OriginFax.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sv.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.PPT svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\OFFICE10.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0285484.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BROCHURE.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DISTLIST.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287642.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART13.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00407_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01151_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_no.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182898.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00231_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02746G.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00694_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\REPORTL.ICO svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fi.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ogalegit.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BDRTKFUL.POC svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00405_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\THOCRAPI.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15019_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG svchost.exe File opened for modification C:\Program Files\Windows Journal\JNTFiltr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107728.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll svchost.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Windows Journal\JNWDRV.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Oriel.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153398.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_bullets.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOCF.DLL svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es-419.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0300520.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Simple.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\List.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_is.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\XLCPRTID.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21433_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WINWORD_COL.HXT svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Omsk svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18208_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0205462.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309598.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01627_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\AD.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DOCS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Newsprint.thmx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRLEX.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15136_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGBOXES.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\REVERSE.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0214098.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239063.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.DEV_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLSLICER.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00127_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XLSLICER.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Installed_schemas14.xss svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\VelvetRose.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\NOTEL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01629_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00170_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll svchost.exe File opened for modification C:\Program Files\RepairRestart.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{5DF2DCA9-BD54-4513-9B32-2C551D72B961}\83.0.4103.106_chrome_installer.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01590_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2ssv.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086424.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00603_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLCTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Brussels svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ExpenseReport.xltx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImage.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF svchost.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02465_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR42F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EquityMergeLetter.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue.css svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\flavormap.properties svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME48.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153091.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01292_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECREC.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ACCOLKI.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00462_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02261_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\awt.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Teal.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Angles.eftx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Magadan svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\CONVERT\OLJRNL.FAE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0212751.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PICTPH.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382948.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\1036\MSGR3FR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21318_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18211_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\charsets.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG svchost.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\EquityLetter.Dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01173_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\EUROTOOL.XLAM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00437_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7FR.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SAVE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LTHD98SP.POC svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JdbcOdbc.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15170_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01474_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00397_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178632.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD10219_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185834.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341645.JPG svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198016.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CALNDR98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\SWBELL.NET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupiconsmask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0196164.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Flow.xml svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Assets.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LABEL98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\JAVA_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBEMAIL.POC svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LABEL.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECRECL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152698.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00732_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01063_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Stationery\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBBA\MSPUB3B.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14791_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\npvlc.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\JUNGLE.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00191_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\TECHTOOL.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15057_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0290548.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN01308_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\HST10 svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IPOLK.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\GREET11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.DPV svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Paris svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VISSHE.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WSIDBR98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGMARQ.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADVCMP.DIC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\ROGERS.COM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0252669.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Library\Analysis\FUNCRES.XLAM svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Sydney svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RECALL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107456.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152430.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216874.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Earthy.css svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Style\ISO690.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143758.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SAFRI_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0234376.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01849_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\OUTEX.ECF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FORMCTL.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BIZFORM.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182689.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00918_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\FOLDER.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Urban.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105710.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tehran svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00218_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONLNTCOMLIB.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00050_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY01462_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEB11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7EN.LEX svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02503U.BMP svchost.exe File created C:\Program Files\Java\jre7\bin\how_to_back_files.html svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\CollectSignatures_Sign.xsn svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15060_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187839.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0174315.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\GRAY.pf svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONMAIN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\SessionOwner.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Groove.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url svchost.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceer35EN.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0212685.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\ACTIVITY.CFG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\PUSH.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0168644.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02092_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02218_.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAME.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\VIEW.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18219_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03224I.JPG svchost.exe File created C:\Program Files\Java\jre7\lib\images\cursors\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00334_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0278702.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18229_.WMF svchost.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216112.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLN.PPT svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02126_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE05930_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02268_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18213_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0215718.WMF svchost.exe File opened for modification C:\Program Files\Windows Journal\NBDoc.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01562U.BMP svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\WORDIRM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0384862.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\US_export_policy.jar svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR6F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01294_.GIF svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\Graph.jtp svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL016.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB_COL.HXC svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105384.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151055.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Vancouver svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15172_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGMARQ.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Elemental.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF svchost.exe File opened for modification C:\Program Files\ConvertFromSkip.iso svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02227_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dcpr.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\how_to_back_files.html svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14539_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105288.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00345_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jsse.jar svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\GKWord.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTORE_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Executive.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Waveform.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore svchost.exe File created C:\Program Files\Microsoft Office\Office14\Document Parts\1033\14\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18247_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IPDESIGN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.XLS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Horizon.thmx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INLAUNCH.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0281638.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00633_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGSTORY.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\VIBE.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGPQUOT.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_10.MID svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME34.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14579_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0315447.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187819.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kabul svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\Access\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CALHM.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME25.CSS svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8 svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\EmbeddedView.jpg svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0384900.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_INIT.XSN svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18182_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0251007.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WORDREP.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potx svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXCEL_F_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21481_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00703L.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EXPTOOWS.XLA svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\release svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASKREQS.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01139_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_increaseindent.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\GRIP.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382960.JPG svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18246_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0186348.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\instrument.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WEBHED98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TWCUTLIN.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21301_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Module.thmx svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_cs.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Asuncion svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZLIB.ACCDE svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0332364.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\TASK.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AccessWeb\RPT2HTM4.XSL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00183_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vienna svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Austin.xml svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\excelcnvpxy.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02752U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00110_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SIGN.CFG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0282928.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00913_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0149407.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151063.WMF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hu.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309904.WMF svchost.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Waveform.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090781.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107496.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GRAPH_COL.HXC svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\OUTEX2.ECF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF svchost.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21480_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Invite or Link.one svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR5B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\Name.accft svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEWBY.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00668_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21325_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0222015.WMF svchost.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01293_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\POSTCARD.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00402_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0229389.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Teal.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\Attachments.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00686_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Andorra svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe svchost.exe File created C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14982_.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\jaccess.jar svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Christmas svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_center.gif svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF svchost.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14656_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Oral svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt svchost.exe File created C:\Program Files\Java\jre7\lib\security\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ADDINS\MSSPC.ECF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21295_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0241037.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02950_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Wordcnvpxy.cnv svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SNIPE.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\ACWIZRC.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Civic.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\System.AddIn.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME28.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02439_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME40.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL00260_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\CALENDAR.GIF svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\VVIEWRES.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DOCL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02400_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44B.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Eucla svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Jamaica svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107746.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0252629.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Technic.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\npt.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18249_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\FiveRules.potx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00034_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\NOTEBOOK.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL083.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\wxpr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21503_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0230553.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00438_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL093.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21296_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105286.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.Infopath.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\OrielLetter.Dotx svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_ON.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\WWINTL.DLL.IDX_DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0183168.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Metro.thmx svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chihuahua svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Origin.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0287005.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107484.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OCRVC.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BZCRD98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART4.BDR svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NAVBARV.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\LightSpirit.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\DISTLSTL.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OIS_F_COL.HXK svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02094_.WMF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15184_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14794_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfxwebkit.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.ICO svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PSRCHLTS.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115863.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OIS.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01394_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00367_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0214948.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21364_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Median.thmx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO01569_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSClientManifest.man svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSTORDB.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CURRENCY.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImageMask.bmp svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00423_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGHEADING.XML svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBWZINT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Aspect.eftx svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME09.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341551.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7FR.LEX svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSGR3ES.LEX svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198226.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01843_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21303_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00200_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kiev svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLKIRM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR38F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00011_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21312_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239191.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0301480.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC2.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02404_.WMF svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\how_to_back_files.html svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\how_to_back_files.html svchost.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0198447.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00395_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02738U.BMP svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\libvlccore.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\MENUS.JS svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Details.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGCINFO.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\QP.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\THROAT.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0174952.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02958_.WMF svchost.exe File opened for modification C:\Program Files\CloseConvert.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18201_.WMF svchost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ENGLISH.LNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL097.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART2.BDR svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\deploy.dll svchost.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\messageboxinfo.ico svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01126_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\SAVE.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR18F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15275_.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\bdcmetadataresource.xsd svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02022_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0232171.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00253_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Sales Pipeline.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297759.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01478U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar svchost.exe File opened for modification C:\Program Files\Windows Journal\Templates\blank.jtp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BIZFORM.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187825.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03464_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\management\jmxremote.access svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\AD98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Northwind.accdt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLBAR.INF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00882_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsoundds.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\AMERITECH.NET.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00915_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01238_.GIF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02097_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.JP.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Grid.eftx svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00487_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ENGDIC.DAT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME47.CSS svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0336075.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0088542.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Premium.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0293828.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CA.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0212601.WMF svchost.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\GREETING.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE02280_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PPINTL.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\MSTHED98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSTORE.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXT svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.ID.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\psuser_64.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceme35.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.DOC svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02075_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107258.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOSTYLE.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SENDTO.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\CALENDAR.GIF svchost.exe File opened for modification C:\Program Files\SubmitGroup.wmf svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0298653.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02743G.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Panama svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\SHOT.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00222_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400002.PNG svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00728_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Prague svchost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\INVITE.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02356_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSPUB.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WCOMP98.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\StatusDoNotDisturb.ico svchost.exe File created C:\Program Files\Microsoft Office\Office14\ADDINS\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTORE.HXS svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309585.JPG svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRID_01.MID svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00192_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN097.XML svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME43.CSS svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFPrevHndlr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15185_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Stationery\1033\PAWPRINT.HTM svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSACCESS.DEV_COL.HXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14830_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Miquelon svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02264_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02058U.BMP svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZDAT12.ACCDU svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01170_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\LASER.WAV svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIconsMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0216588.WMF svchost.exe File opened for modification C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PEOPLEDATAHANDLER.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02752G.GIF svchost.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImagesMask.bmp svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLN.DOC svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\default.jfc svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18210_.WMF svchost.exe File created C:\Program Files\Java\jre7\lib\zi\America\how_to_back_files.html svchost.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ar.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\EMAIL11.POC svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21333_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunec.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107452.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00255_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107512.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02054_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABOFF.JPG svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187847.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apex.xml svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Black Tie.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Efate svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0199805.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\FLYER.DPV svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00641_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02417_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00305_.WMF svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7 svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Casual.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0196400.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_08.MID svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MCPS.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR23F.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00673L.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0237225.WMF svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bogota svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21334_.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0252349.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6 svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sitka svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSTORES.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue.css svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SCNPST64.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00957_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18256_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF svchost.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\how_to_back_files.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK_K_COL.HXK svchost.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18232_.WMF svchost.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01157_.WMF svchost.exe File opened for modification C:\Program Files\Java\jre7\release svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dubai svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac svchost.exe