Hi Robert,
I managed to run the commands you recommended and here are the results:
PS C:\WINDOWS> dir -Re -Fi "Flash*" | Sort-Object Name, CreationTime | ft Length, FullName -AutoSize
dir : Access to the path 'C:\WINDOWS\System32\LogFiles\WMI\RtBackup' is denied.
At line:1 char:1
- dir -Re -Fi "Flash*" | Sort-Object Name, CreationTime | ft Length, FullName -Au ...
-
+ CategoryInfo : PermissionDenied: (C:\WINDOWS\Syst...es\WMI\RtBackup:String) [Get-ChildItem], UnauthorizedAccessException
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
Length FullName
------ --------
C:\WINDOWS\System32\Macromed\Flash
C:\WINDOWS\SysWOW64\Macromed\Flash
C:\WINDOWS\System32\config\systemprofile\AppData\Roaming\Adobe\Flash Player
939224 C:\WINDOWS\SysWOW64\Flash.OCX
18617824 C:\WINDOWS\SysWOW64\Macromed\Flash\Flash.ocx
23878624 C:\WINDOWS\System32\Macromed\Flash\Flash.ocx
1216015 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.16407_none_270c708771a3c5dc\Flash.ocx
1863328 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.16407_none_1cb7c6353d4303e1\Flash.ocx
3936150 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_26d447a971ce3b5d\Flash.ocx
4870842 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_1c7f9d573d6d7962\Flash.ocx
1254979 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_26b0d8ed71e94052\Flash.ocx
1631375 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_1c5c2e9b3d887e57\Flash.ocx
18617824 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_26a909df71eea848\Flash.ocx
23878624 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_1c545f8d3d8de64d\Flash.ocx
1631375 C:\WINDOWS\WinSxS\Temp\InFlight\d34050c2a709d00102000000b40fc00d\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_1c5c2e9b3d887e57\Flash.ocx
10478 C:\WINDOWS\System32\Macromed\Flash\FlashInstall.log
13934 C:\WINDOWS\SysWOW64\Macromed\Flash\FlashInstall.log
856 C:\WINDOWS\SysWOW64\Macromed\Flash\flashplayer.xpt
714208 C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
45450 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_26d447a971ce3b5d\FlashPlayerApp.exe
2009 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_26b0d8ed71e94052\FlashPlayerApp.exe
714208 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_26a909df71eea848\FlashPlayerApp.exe
106976 C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
9730 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_26d447a971ce3b5d\FlashPlayerCPLApp.cpl
1941 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_26b0d8ed71e94052\FlashPlayerCPLApp.cpl
106976 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_26a909df71eea848\FlashPlayerCPLApp.cpl
1880752 C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
267440 C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
26424 C:\WINDOWS\Prefetch\FLASHPLAYERUPDATESERVICE.EXE-216D9C35.pf
11561 C:\WINDOWS\System32\DriverStore\FileRepository\flashusb.inf_amd64_d97dba44a43ee5a9\flashusb.cat
8178 C:\WINDOWS\System32\DriverStore\FileRepository\flashusb.inf_amd64_d97dba44a43ee5a9\flashusb.inf
C:\WINDOWS\System32\DriverStore\FileRepository\flashusb.inf_amd64_d97dba44a43ee5a9
11680 C:\WINDOWS\System32\DriverStore\FileRepository\flashusb.inf_amd64_d97dba44a43ee5a9\flashusb.PNF
19968 C:\WINDOWS\System32\DriverStore\FileRepository\flashusb.inf_amd64_d97dba44a43ee5a9\FlashUSB.sys
549856 C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.dll
606688 C:\WINDOWS\System32\Macromed\Flash\FlashUtil_ActiveX.dll
40214 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.16407_none_1cb7c6353d4303e1\FlashUtil_ActiveX.dll
45600 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_26d447a971ce3b5d\FlashUtil_ActiveX.dll
54867 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_1c7f9d573d6d7962\FlashUtil_ActiveX.dll
2086 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_26b0d8ed71e94052\FlashUtil_ActiveX.dll
2054 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_1c5c2e9b3d887e57\FlashUtil_ActiveX.dll
606688 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_1c545f8d3d8de64d\FlashUtil_ActiveX.dll
549856 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_26a909df71eea848\FlashUtil_ActiveX.dll
2054 C:\WINDOWS\WinSxS\Temp\InFlight\d34050c2a709d00102000000b40fc00d\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_1c5c2e9b3d887e57\FlashUtil_ActiveX.dll
898528 C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil_ActiveX.exe
573920 C:\WINDOWS\System32\Macromed\Flash\FlashUtil_ActiveX.exe
595283 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.16407_none_270c708771a3c5dc\FlashUtil_ActiveX.exe
228016 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.16407_none_1cb7c6353d4303e1\FlashUtil_ActiveX.exe
260593 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_1c7f9d573d6d7962\FlashUtil_ActiveX.exe
614032 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17355_none_26d447a971ce3b5d\FlashUtil_ActiveX.exe
216400 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_1c5c2e9b3d887e57\FlashUtil_ActiveX.exe
582202 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_26b0d8ed71e94052\FlashUtil_ActiveX.exe
573920 C:\WINDOWS\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_1c545f8d3d8de64d\FlashUtil_ActiveX.exe
898528 C:\WINDOWS\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17495_none_26a909df71eea848\FlashUtil_ActiveX.exe
216400 C:\WINDOWS\WinSxS\Temp\InFlight\d34050c2a709d00102000000b40fc00d\amd64_adobe-flash-for-windows_31bf3856ad364e35_6.3.9600.17482_none_1c5c2e9b3d887e57\FlashUtil_ActiveX.exe
48374 C:\WINDOWS\Prefetch\FLASHUTIL_ACTIVEX.EXE-C484AAB9.pf
855216 C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_239_Plugin.exe
540848 C:\WINDOWS\System32\Macromed\Flash\FlashUtil64_15_0_0_239_Plugin.exe
The dssec.dat results:
PS C:\WINDOWS> dir -Re -Fi "dssec.dat" | Sort-Object Name, LastWriteTime | ft Length, FullName -AutoSize
dir : Access to the path 'C:\WINDOWS\System32\LogFiles\WMI\RtBackup' is denied.
At line:1 char:1
- dir -Re -Fi "dssec.dat" | Sort-Object Name, LastWriteTime | ft Length, FullName ...
-
+ CategoryInfo : PermissionDenied: (C:\WINDOWS\Syst...es\WMI\RtBackup:String) [Get-ChildItem], UnauthorizedAccessException
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
Length FullName
215943 C:\WINDOWS\System32\dssec.dat
215943 C:\WINDOWS\SysWOW64\dssec.dat
215943 C:\WINDOWS\WinSxS\amd64_microsoft-windows-dssec_31bf3856ad364e35_6.3.9600.17415_none_4b70d269d045459a\dssec.dat
215943 C:\WINDOWS\WinSxS\x86_microsoft-windows-dssec_31bf3856ad364e35_6.3.9600.17415_none_ef5236e617e7d464\dssec.dat
215943 C:\WINDOWS\WinSxS\x86_microsoft-windows-dssec_31bf3856ad364e35_6.3.9600.16384_none_ef059c0a182167dc\dssec.dat
8489 C:\WINDOWS\WinSxS\amd64_microsoft-windows-dssec_31bf3856ad364e35_6.3.9600.16384_none_4b24378dd07ed912\dssec.dat
Once more, thanks for your continued help with this.
Regards,
Richard