Good Day,

I have not found a solution to the problem I am having. All my search results are bogus, I've seen this problem on many sites with no viable solution for me. I work have been working in the field for many years and have cleaned many machines. I am a firm believer in reading and doing all instructions. I have read and done all sugested "cleaning" AA,SP,MB,CBfix,Sdfix,stinger,rootkitreavealer, and last but not least HJT. Oh, and Vexira. Nothing has been found on my PC, it runs fine, not popups and any other strange behavior. However, my search results are still bogus. And only on this machine when compaired with results from another box.

I support almost 2,000 computers for a school district, reloading is somtimes an option, however this is my personal PC, I'd rather spend two weeks trying to get this fixed than to reload all I have on this box.

Thanks so much for all you help. If their is anything I can do to help please let me know.

Peace,

Lee

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:32, on 2008-09-28
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
f:\Program Files\Hewlett-Packard\PNM\server\mysql\bin\mysqld-max-nt.exe
f:\Program Files\Hewlett-Packard\PNM\server\Wrapper.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
f:\Program Files\Hewlett-Packard\PNM\jre\bin\javaw.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\StacSV.exe
C:\PROGRA~1\VEXIRA~1\Bin\vbcmserv.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
f:\Program Files\Hewlett-Packard\PNM\server\bin\TLS.exe
f:\Program Files\Hewlett-Packard\PNM\server\bin\Trafficd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\S4F\Filter7.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\PROGRA~1\VEXIRA~1\Bin\vbsystry.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Palm\Hotsync.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = squid.asheboro.k12.nc.us:3128
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [S4F] "C:\Program Files\S4F\Filter7.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [VBSysTray] "C:\PROGRA~1\VEXIRA~1\Bin\vbsystry.exe"
O4 - HKLM\..\Run: [AVLoginToDo] "C:\PROGRA~1\VEXIRA~1\Bin\avltd.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Startup: Palm Registration.lnk = C:\Program Files\Palm\register.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1222568887484
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O17 - HKLM\Software\..\Telephony: DomainName = asheboro.k12.nc.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: HP ProCurve Datastore - Unknown owner - f:\Program Files\Hewlett-Packard\PNM\server\mysql\bin\mysqld-max-nt.exe
O23 - Service: HP ProCurve Network Manager Server - Unknown owner - f:\Program Files\Hewlett-Packard\PNM\server\Wrapper.exe
O23 - Service: HP ProCurve Traffic Launch Service (HPTLS) - Hewlett-Packard - f:\Program Files\Hewlett-Packard\PNM\server\bin\TLS.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SolarWinds TFTP Server - SolarWinds - C:\Program Files\SolarWinds\TFTPServer\SolarWinds TFTP Server.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Vexira Antivirus Component Manager Service (VACompManService) - Central Command, Inc. - C:\PROGRA~1\VEXIRA~1\Bin\vbcmserv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 7642 bytes

Hi,
Welcome to the site

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

I want you to show hidden files. There are instructions HERE to help you do this.
You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in Safe Mode so you will be unable to access this thread at that time.
Please dont use any of the tools without specific instructions. Some of them are dangerous (and could leave your computer in worse condition that it is when infected) if used incorrectly.
These instructions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat.

Hi,
Did you install these?

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = squid.asheboro.k12.nc.us:3128
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O17 - HKLM\Software\..\Telephony: DomainName = asheboro.k12.nc.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us

Are these for the school you mentioned?


This post has been edited by sarahw: Sep 30 2008, 01:58 AM

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

Topic reopened at OP's request

Yes these values have been created as being a part of the school domain.

squid.asheboro.k12.nc.us is our proxy server.

Hi,
I know you said you tried a few programs but I'd like to see some scans first.

1.
Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan (Full scan is optional. According to the program's creator Quick Scan will do just fine.).
Click Scan.
When the scan is complete, click OK, then Show Results to view the results.

If Malware is found...
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad.
Please save it to your desktop.

NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen:

Launch Malwarebytes' Anti-Malware.
Click the Logs tab.
Double-click log-mm.dd.yyyy [xxxxxx].txt.

In your next reply post the Malwarebytes' Anti-Malware log.

2.

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Please notice the date of these logs. I have included the original logs, from the time when I first ran the program...and as you can see the system was infected with a BHO trojan(at that time)...however after cleaning the system, I still had the problem, so I ran the program several more times. And, also as you can see I am no longer getting any reported infections, however I still have the exact same problem.

Thank you for all your help.

Malwarebytes' Anti-Malware 1.28
Database version: 1216
Windows 5.1.2600 Service Pack 3

2008-09-27 10:24:14 PM
mbam-log-2008-09-27 (22-24-14).txt

Scan type: Quick Scan
Objects scanned: 72962
Time elapsed: 2 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\cdmyidd.securitytoolbar (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{cd24eb02-9831-4838-99d0-726d411b1328} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f20da564-9254-49fe-a678-cc3cef172252} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cdmyidd.securitytoolbar.1 (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\lclark\Local Settings\Application Data\CyberDefender\cdmyidd.dll (Trojan.BHO) -> Quarantined and deleted successfully.

*******************************************
*******************************************
************ NEW LOG **********************

Malwarebytes' Anti-Malware 1.28
Database version: 1216
Windows 5.1.2600 Service Pack 3

2008-09-27 11:06:30 PM
mbam-log-2008-09-27 (23-06-30).txt

Scan type: Quick Scan
Objects scanned: 73401
Time elapsed: 2 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

*******************************************
*******************************************
************ NEW LOG **********************

Malwarebytes' Anti-Malware 1.28
Database version: 1219
Windows 5.1.2600 Service Pack 3

2008-09-28 12:53:45 PM
mbam-log-2008-09-28 (12-53-45).txt

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 181187
Time elapsed: 27 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

*******************************************
*******************************************
************ NEW LOG **********************
************ TODAY ***********************

Malwarebytes' Anti-Malware 1.28
Database version: 1242
Windows 5.1.2600 Service Pack 3

10/8/08 9:12:35 AM
mbam-log-2008-10-08 (09-12-34).txt

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 186613
Time elapsed: 41 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

******************************************************************
******************************************************************
***************** LOG.TXT *****************************************

Logfile of random's system information tool 1.04 (written by random/random)
Run by lclark at 2008-10-08 09:16:36
Microsoft Windows XP Professional Service Pack 3
System drive C: has 6 GB (21%) free of 30 GB
Total RAM: 3574 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:44 AM, on 10/8/08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
f:\Program Files\Hewlett-Packard\PNM\server\mysql\bin\mysqld-max-nt.exe
f:\Program Files\Hewlett-Packard\PNM\server\Wrapper.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
f:\Program Files\Hewlett-Packard\PNM\jre\bin\javaw.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\StacSV.exe
C:\PROGRA~1\VEXIRA~1\Bin\vbcmserv.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\system32\vmnetdhcp.exe
f:\Program Files\Hewlett-Packard\PNM\server\bin\TLS.exe
f:\Program Files\Hewlett-Packard\PNM\server\bin\Trafficd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\VEXIRA~1\Bin\vbsystry.exe
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\lclark\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\lclark.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = squid.asheboro.k12.nc.us:3128
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [VBSysTray] "C:\PROGRA~1\VEXIRA~1\Bin\vbsystry.exe"
O4 - HKLM\..\Run: [AVLoginToDo] "C:\PROGRA~1\VEXIRA~1\Bin\avltd.exe"
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1222568887484
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O17 - HKLM\Software\..\Telephony: DomainName = asheboro.k12.nc.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = asheboro.k12.nc.us
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: HP ProCurve Datastore - Unknown owner - f:\Program Files\Hewlett-Packard\PNM\server\mysql\bin\mysqld-max-nt.exe
O23 - Service: HP ProCurve Network Manager Server - Unknown owner - f:\Program Files\Hewlett-Packard\PNM\server\Wrapper.exe
O23 - Service: HP ProCurve Traffic Launch Service (HPTLS) - Hewlett-Packard - f:\Program Files\Hewlett-Packard\PNM\server\bin\TLS.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SolarWinds TFTP Server - SolarWinds - C:\Program Files\SolarWinds\TFTPServer\SolarWinds TFTP Server.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: Vexira Antivirus Component Manager Service (VACompManService) - Central Command, Inc. - C:\PROGRA~1\VEXIRA~1\Bin\vbcmserv.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 8690 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\DailyBackup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2007-02-21 819200]
"IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2007-02-21 970752]
"ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-07-27 221184]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-07-27 81920]
"PDVDDXSrv"=C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [2006-10-20 118784]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-07-02 159744]
"RoxioDragToDisc"=C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe [2006-08-17 1116920]
"Dell QuickSet"=C:\Program Files\Dell\QuickSet\quickset.exe [2007-07-20 1228800]
"SigmatelSysTrayApp"=C:\WINDOWS\stsystra.exe [2007-02-19 303104]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-05-16 138008]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-05-16 162584]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-05-16 138008]
"VBSysTray"=C:\PROGRA~1\VEXIRA~1\Bin\vbsystry.exe [2008-03-26 239000]
"AVLoginToDo"=C:\PROGRA~1\VEXIRA~1\Bin\avltd.exe [2008-04-24 50552]
"vmware-tray"=C:\Program Files\VMware\VMware Workstation\vmware-tray.exe [2008-09-18 84528]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-08-30 4670704]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HotSync Manager.lnk - C:\Program Files\Palm\Hotsync.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-05-16 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\VMware\VMware Workstation\vmware-authd.exe"="C:\Program Files\VMware\VMware Workstation\vmware-authd.exe:*:Enabled:VMware Authd"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"F:\cygwin\usr\X11R6\bin\XWin.exe"="F:\cygwin\usr\X11R6\bin\XWin.exe:*:Enabled:XWin"
"C:\Program Files\Vexira Antivirus\Bin\vbsystry.exe"="C:\Program Files\Vexira Antivirus\Bin\vbsystry.exe:*:Enabled:Vexira Antivirus System Tray Application"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26483816-2760-11dd-bdeb-001a6b89ec75}]
shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29f50808-7b55-11dd-a955-001f3ca8c3f6}]
shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d03eb238-88f0-11dd-a442-0021864c4c4c}]
shell\AutoRun\command - G:\setupSNK.exe


======List of files/folders created in the last 3 months======

2008-10-08 09:16:36 ----D---- C:\rsit
2008-10-08 08:19:20 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-30 10:08:34 ----D---- C:\Program Files\Palm Inc
2008-09-28 19:47:07 ----SHD---- C:\RECYCLER
2008-09-28 19:46:02 ----D---- C:\Documents and Settings\lclark\Application Data\VMware
2008-09-28 19:40:25 ----RA---- C:\WINDOWS\system32\vnetinst.dll
2008-09-28 19:40:19 ----A---- C:\WINDOWS\system32\vmnetdhcp.exe
2008-09-28 19:40:15 ----A---- C:\WINDOWS\system32\vmnat.exe
2008-09-28 19:40:11 ----RA---- C:\WINDOWS\system32\vmnetbridge.dll
2008-09-28 19:40:01 ----A---- C:\WINDOWS\system32\vnetlib.dll
2008-09-28 19:38:19 ----D---- C:\Documents and Settings\All Users\Application Data\VMware
2008-09-28 19:37:55 ----D---- C:\Program Files\VMware
2008-09-28 19:33:59 ----D---- C:\vmwafe
2008-09-28 13:07:25 ----D---- C:\SDFix
2008-09-28 13:03:20 ----A---- C:\ComboFix.txt
2008-09-28 13:00:40 ----D---- C:\QooBox
2008-09-28 13:00:36 ----A---- C:\WINDOWS\zip.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\VFind.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\swxcacls.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\SWSC.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\swreg.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\sed.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\Nircmd.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\grep.exe
2008-09-28 13:00:36 ----A---- C:\WINDOWS\fdsv.exe
2008-09-28 11:05:22 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-28 10:07:53 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-27 23:00:12 ----D---- C:\Avenger
2008-09-27 23:00:11 ----A---- C:\avenger.txt
2008-09-27 22:45:18 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-27 22:44:12 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-09-27 22:44:08 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-27 22:44:03 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-09-27 22:43:57 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-09-27 22:43:54 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-09-27 22:43:49 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-09-27 22:43:45 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
2008-09-27 22:43:40 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-09-27 22:43:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-09-27 22:43:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-09-27 22:43:25 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-27 22:43:23 ----D---- C:\Program Files\MSXML 4.0
2008-09-27 22:43:13 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-09-27 22:42:57 ----D---- C:\WINDOWS\ie7updates
2008-09-27 22:42:37 ----D---- C:\WINDOWS\WBEM
2008-09-27 22:41:36 ----HDC---- C:\WINDOWS\ie7
2008-09-27 22:41:30 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2008-09-27 22:41:08 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2008-09-27 22:39:52 ----A---- C:\WINDOWS\system32\MRT.exe
2008-09-27 22:30:47 ----D---- C:\Program Files\Trend Micro
2008-09-27 22:30:12 ----D---- C:\WINDOWS\system32\PreInstall
2008-09-27 22:30:10 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2008-09-27 22:30:10 ----HD---- C:\WINDOWS\$hf_mig$
2008-09-27 22:28:43 ----A---- C:\WINDOWS\system32\wups2.dll
2008-09-27 22:28:43 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2008-09-27 22:28:42 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2008-09-27 22:28:42 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2008-09-27 22:28:42 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2008-09-27 22:20:10 ----D---- C:\Documents and Settings\lclark\Application Data\Malwarebytes
2008-09-27 22:20:07 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-27 21:17:22 ----D---- C:\Program Files\Common Files\Cisco Systems
2008-09-27 19:43:44 ----D---- C:\WINDOWS\Prefetch
2008-09-27 19:38:06 ----N---- C:\WINDOWS\system32\comsdupd.exe
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dot3svc.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dot3msm.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dot3api.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dimsroam.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\credssp.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\ati3duag.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2008-09-27 19:38:04 ----N---- C:\WINDOWS\system32\aaclient.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eapsvc.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eapqec.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eappprxy.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eapphost.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eappgnui.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eappcfg.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\eapolqec.dll
2008-09-27 19:38:03 ----N---- C:\WINDOWS\system32\dot3ui.dll
2008-09-27 19:38:02 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2008-09-27 19:38:02 ----N---- C:\WINDOWS\system32\kmsvc.dll
2008-09-27 19:38:02 ----N---- C:\WINDOWS\system32\kbdpash.dll
2008-09-27 19:38:02 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2008-09-27 19:38:02 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\qagent.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\onex.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\nv4_disp.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\napstat.exe
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\napmontr.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\napipsec.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\mssha.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\mmcperf.exe
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\mmcex.dll
2008-09-27 19:38:01 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\wlanapi.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\verclsid.exe
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\tzchange.exe
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\tspkg.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\tsgqec.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\slserv.exe
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\slrundll.exe
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\slgen.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\slextspk.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\slcoinst.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\setupn.exe
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\s3gnb.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\rasqec.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\qutil.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\qcliprov.dll
2008-09-27 19:38:00 ----N---- C:\WINDOWS\system32\qagentrt.dll
2008-09-27 19:37:59 ----N---- C:\WINDOWS\system32\xpsp3res.dll
2008-09-27 19:37:59 ----N---- C:\WINDOWS\system32\xmllite.dll
2008-09-27 19:37:59 ----N---- C:\WINDOWS\slrundll.exe
2008-09-27 19:37:58 ----D---- C:\WINDOWS\system32\scripting
2008-09-27 19:37:58 ----D---- C:\WINDOWS\l2schemas
2008-09-27 19:37:57 ----D---- C:\WINDOWS\system32\en
2008-09-27 19:37:57 ----D---- C:\WINDOWS\system32\bits
2008-09-27 19:36:52 ----D---- C:\WINDOWS\ServicePackFiles
2008-09-27 19:35:17 ----D---- C:\WINDOWS\network diagnostic
2008-09-27 19:33:49 ----A---- C:\WINDOWS\003167_.tmp
2008-09-27 19:31:36 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-09-27 19:00:23 ----A---- C:\Boot.bak
2008-09-27 19:00:19 ----D---- C:\cmdcons
2008-09-27 18:59:00 ----D---- C:\WINDOWS\erdnt
2008-09-22 18:05:03 ----D---- C:\Documents and Settings\lclark\Application Data\OpenOffice.org2
2008-09-22 18:02:55 ----D---- C:\Program Files\OpenOffice.org 2.4
2008-09-22 18:02:33 ----A---- C:\WINDOWS\system32\javaws.exe
2008-09-22 18:02:33 ----A---- C:\WINDOWS\system32\javaw.exe
2008-09-22 18:02:33 ----A---- C:\WINDOWS\system32\java.exe
2008-09-19 19:18:43 ----D---- C:\Documents and Settings\lclark\Application Data\Mozilla
2008-09-19 19:18:37 ----D---- C:\Program Files\Mozilla Firefox
2008-09-18 18:25:52 ----A---- C:\WINDOWS\system32\vmnc.dll
2008-09-16 09:41:50 ----A---- C:\WINDOWS\system32\myodbcinst.exe
2008-09-16 09:41:50 ----A---- C:\WINDOWS\system32\myodbc3S.dll
2008-09-16 09:41:50 ----A---- C:\WINDOWS\system32\myodbc3.dll
2008-09-16 09:41:50 ----A---- C:\WINDOWS\system32\imyodbc.exe
2008-09-16 09:40:10 ----HD---- C:\Program Files\Zero G Registry
2008-09-13 22:39:52 ----D---- C:\Program Files\NetBeans 6.1
2008-09-07 00:02:07 ----D---- C:\Program Files\GPMC
2008-09-07 00:00:22 ----D---- C:\WINDOWS\system32\URTTEMP
2008-09-05 23:30:42 ----N---- C:\WINDOWS\system32\WgaLogon.dll
2008-09-05 23:29:58 ----N---- C:\WINDOWS\system32\WgaTray.exe
2008-09-05 10:17:31 ----A---- C:\WINDOWS\system32\igfxres.dll
2008-08-28 14:19:39 ----D---- C:\Program Files\Audacity
2008-08-23 17:42:58 ----A---- C:\NAMS_2013.txt
2008-08-23 17:42:38 ----A---- C:\NAMS_2014.txt
2008-08-23 17:42:24 ----A---- C:\NAMS_2015.txt
2008-08-23 17:42:03 ----A---- C:\SAMS_2015.txt
2008-08-23 17:33:20 ----A---- C:\SAMS_2014.txt
2008-08-23 17:33:03 ----A---- C:\SAMS_2013.txt
2008-08-23 17:28:35 ----A---- C:\WINDOWS\Sams_2015.txt
2008-08-23 17:26:24 ----A---- C:\WINDOWS\Nams_2013.txt
2008-08-21 09:43:43 ----D---- C:\WINDOWS\ERUNT
2008-08-21 09:41:03 ----A---- C:\WINDOWS\ntbtlog.txt
2008-08-13 10:25:01 ----D---- C:\Documents and Settings\lclark\Application Data\Symantec
2008-08-13 10:21:07 ----RA---- C:\WINDOWS\patchw32.dll
2008-08-13 10:18:34 ----RA---- C:\WINDOWS\pw32a.dll
2008-08-13 10:11:38 ----A---- C:\WINDOWS\system32\capicom.dll
2008-08-13 10:10:08 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2008-08-13 10:08:24 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-13 10:08:12 ----D---- C:\Program Files\Symantec
2008-08-12 11:12:35 ----D---- C:\Perl
2008-08-10 00:14:41 ----D---- C:\Documents and Settings\lclark\Application Data\Yahoo!
2008-08-10 00:12:13 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-10 00:11:33 ----A---- C:\YServer.txt
2008-08-10 00:11:17 ----D---- C:\Program Files\Yahoo!
2008-08-04 11:09:27 ----D---- C:\Program Files\Dell_HostCD
2008-08-04 11:09:23 ----A---- C:\WINDOWS\DKAAP2DD.ini
2008-08-04 10:58:19 ----A---- C:\WINDOWS\system32\LexLog.dll
2008-08-04 10:58:18 ----A---- C:\WINDOWS\DKAAJ2DD.ini
2008-07-25 09:56:24 ----D---- C:\test2
2008-07-25 09:55:07 ----D---- C:\test
2008-07-24 09:27:42 ----D---- C:\Program Files\AdventNet
2008-07-22 15:35:11 ----D---- C:\WINDOWS\Minidump
2008-07-21 09:25:17 ----D---- C:\Program Files\Faronics
2008-07-18 14:46:17 ----A---- C:\Modify_Description_Add_Title_Computers.vbs
2008-07-16 08:42:28 ----D---- C:\Program Files\Support Tools
2008-07-14 12:14:38 ----D---- C:\ADSI Scriptomatic
2008-07-14 12:12:35 ----D---- C:\Program Files\Windows Resource Kits
2008-07-14 12:10:00 ----A---- C:\WINDOWS\system32\adsiedit.msc
2008-07-14 12:10:00 ----A---- C:\WINDOWS\system32\adsiedit.dll

======List of files/folders modified in the last 3 months======

2008-10-08 08:20:28 ----D---- C:\WINDOWS\system32\drivers
2008-10-08 08:19:20 ----RD---- C:\Program Files
2008-10-08 08:15:46 ----D---- C:\WINDOWS\system32
2008-10-08 08:15:46 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-08 08:15:16 ----D---- C:\WINDOWS\system32\inetsrv
2008-10-08 08:13:22 ----D---- C:\MDT
2008-10-08 08:12:51 ----D---- C:\WINDOWS\Temp
2008-10-08 08:11:48 ----D---- C:\WINDOWS\security
2008-10-07 23:15:08 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-07 14:00:02 ----D---- C:\WINDOWS\system32\NtmsData
2008-10-06 16:15:42 ----D---- C:\TMP_CMS
2008-10-06 14:00:09 ----D---- C:\WINDOWS\Registration
2008-10-03 16:24:43 ----SHD---- C:\WINDOWS\CSC
2008-10-01 14:28:09 ----SHD---- C:\WINDOWS\Installer
2008-10-01 14:27:55 ----D---- C:\Documents and Settings
2008-09-30 10:25:25 ----A---- C:\additdiag.txt
2008-09-30 10:08:34 ----D---- C:\Program Files\Palm
2008-09-30 09:54:32 ----D---- C:\WINDOWS\system32\CatRoot2
2008-09-30 09:51:36 ----D---- C:\Program Files\Common Files\DataViz
2008-09-29 15:12:18 ----HD---- C:\WINDOWS\inf
2008-09-28 23:27:54 ----D---- C:\WINDOWS\SchCache
2008-09-28 19:44:32 ----D---- C:\WINDOWS
2008-09-28 19:38:52 ----D---- C:\WINDOWS\WinSxS
2008-09-28 17:30:11 ----D---- C:\WINDOWS\system
2008-09-28 17:30:10 ----D---- C:\Program Files\S4F
2008-09-28 15:41:40 ----D---- C:\Program Files\Common Files
2008-09-28 13:02:39 ----A---- C:\WINDOWS\system.ini
2008-09-28 13:02:15 ----D---- C:\WINDOWS\AppPatch
2008-09-27 23:26:34 ----HD---- C:\Program Files\InstallShield Installation Information
2008-09-27 23:26:23 ----D---- C:\Program Files\Vexira Antivirus
2008-09-27 22:50:28 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-09-27 22:50:01 ----D---- C:\WINDOWS\Help
2008-09-27 22:50:01 ----D---- C:\Program Files\Internet Explorer
2008-09-27 22:44:15 ----A---- C:\WINDOWS\imsins.BAK
2008-09-27 22:43:55 ----D---- C:\Program Files\Messenger
2008-09-27 22:43:05 ----D---- C:\WINDOWS\system32\en-us
2008-09-27 22:42:32 ----D---- C:\WINDOWS\Media
2008-09-27 22:28:47 ----D---- C:\WINDOWS\SoftwareDistribution
2008-09-27 22:28:13 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-09-27 22:09:09 ----A---- C:\WINDOWS\win.ini
2008-09-27 21:37:53 ----D---- C:\WINDOWS\system32\appmgmt
2008-09-27 21:35:36 ----D---- C:\Program Files\MSN
2008-09-27 21:14:57 ----SD---- C:\WINDOWS\Tasks
2008-09-27 21:14:57 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-09-27 21:12:10 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-27 19:45:14 ----A---- C:\WINDOWS\OEWABLog.txt
2008-09-27 19:43:44 ----A---- C:\WINDOWS\setuplog.txt
2008-09-27 19:43:09 ----D---- C:\WINDOWS\system32\Setup
2008-09-27 19:43:08 ----D---- C:\WINDOWS\system32\wbem
2008-09-27 19:43:07 ----RSD---- C:\WINDOWS\Fonts
2008-09-27 19:41:06 ----D---- C:\WINDOWS\system32\CatRoot
2008-09-27 19:38:19 ----D---- C:\Program Files\Windows Media Player
2008-09-27 19:38:05 ----D---- C:\WINDOWS\ime
2008-09-27 19:37:58 ----D---- C:\WINDOWS\system32\usmt
2008-09-27 19:37:57 ----D---- C:\WINDOWS\PeerNet
2008-09-27 19:37:57 ----D---- C:\Program Files\Movie Maker
2008-09-27 19:36:42 ----D---- C:\WINDOWS\system32\Restore
2008-09-27 19:36:41 ----D---- C:\WINDOWS\system32\npp
2008-09-27 19:36:41 ----D---- C:\WINDOWS\mui
2008-09-27 19:36:41 ----D---- C:\WINDOWS\msagent
2008-09-27 19:36:40 ----D---- C:\WINDOWS\srchasst
2008-09-27 19:36:39 ----D---- C:\WINDOWS\system32\Com
2008-09-27 19:36:39 ----D---- C:\Program Files\NetMeeting
2008-09-27 19:36:37 ----D---- C:\Program Files\Windows NT
2008-09-27 19:36:37 ----D---- C:\Program Files\Outlook Express
2008-09-27 19:36:34 ----D---- C:\Program Files\Common Files\System
2008-09-27 19:36:20 ----D---- C:\WINDOWS\system32\oobe
2008-09-27 19:35:04 ----RASH---- C:\NTDETECT.COM
2008-09-27 19:33:43 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-09-27 19:31:33 ----D---- C:\WINDOWS\ehome
2008-09-27 19:28:59 ----D---- C:\WINDOWS\Debug
2008-09-27 19:00:23 ----RASH---- C:\boot.ini
2008-09-26 15:19:05 ----SD---- C:\Documents and Settings\lclark\Application Data\Microsoft
2008-09-25 20:58:06 ----D---- C:\Documents and Settings\lclark\Application Data\U3
2008-09-22 18:03:48 ----RSD---- C:\WINDOWS\assembly
2008-09-22 18:02:32 ----D---- C:\Program Files\Java
2008-09-15 16:23:05 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-05 23:30:06 ----A---- C:\WINDOWS\system32\LegitCheckControl.dll
2008-09-01 22:42:37 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-08-17 18:33:07 ----A---- C:\WINDOWS\FileNamesinQueue.ini
2008-08-08 09:05:45 ----RASH---- C:\boot.ini.bak
2008-08-04 10:58:19 ----D---- C:\Program Files\Dell
2008-07-30 12:48:53 ----D---- C:\dell
2008-07-24 11:00:48 ----D---- C:\WINDOWS\Microsoft.NET
2008-07-24 09:21:42 ----D---- C:\WINDOWS\system32\XPSViewer
2008-07-18 22:10:48 ----A---- C:\WINDOWS\system32\cdm.dll
2008-07-18 22:10:42 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-07-18 22:10:20 ----A---- C:\WINDOWS\system32\wups.dll
2008-07-18 22:09:46 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-07-18 22:09:44 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-07-18 22:09:42 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-07-17 11:26:36 ----A---- C:\WINDOWS\ODBC.INI
2008-07-10 09:25:34 ----D---- C:\Program Files\SBS Resource Kit

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 APPDRV;APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [2005-08-12 16128]
R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2006-08-11 12920]
R1 DLARTL_M;DLARTL_M; C:\WINDOWS\System32\Drivers\DLARTL_M.SYS [2006-08-11 28184]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 Tosrfcom;Bluetooth RFCOMM; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2005-08-01 64896]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.6.0.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-05-21 21425]
R2 DLABMFSM;DLABMFSM; C:\WINDOWS\System32\DLA\DLABMFSM.SYS [2006-08-18 35096]
R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2006-08-18 32472]
R2 DLADResM;DLADResM; C:\WINDOWS\System32\DLA\DLADResM.SYS [2006-08-18 9400]
R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2006-08-18 104472]
R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\