[schlep]

idle for a week.. I thought I got it and well, true to form, I did not. I got no help from another *Bleep* site. Anyway, long and short of it. I have run MBAM, Spybot SD and thought they got it as results came back clean and nothing really happened for a couple of days. Well, I started having browser issues after uninstalling IE7 and thought it was a microsoft issue. Well, after some research, turns out it may be malware. So I ran Kaspersky, wham, trend got a hit not two minutes into scan, almost right away. Kaspersky picked up (4), three in the trend directory and (1) in the sys32 dir. Then , after all this came to light, I get slammed with 65 browsers opening. This is a work PC and I NEED THIS Resolved stat. I am dying here. I am afraid to turn on my wi fi. I awoke something on this day, and it aint pretty. Here are my logs. RSIT, Kaspersky and MBAM..


EDIT: I also rcvd an ANTIVIRUS 2009 pop up today as well. Not sure if it is pertinent but any and all info can help.

RSIT Log

Logfile of random's system information tool 1.04 (written by random/random)
Run by ShaEvans at 2008-11-26 15:32:55
Microsoft Windows XP Professional Service Pack 3
System drive C: has 46 GB (61%) free of 76 GB
Total RAM: 2039 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:33:11 PM, on 11/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\ActivIdentity\ActivClient\accoca.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\WINDOWS\system32\ifxspmgt.exe
c:\WINDOWS\system32\ifxtcs.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
c:\WINDOWS\system32\IfxPsdSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\WINDOWS\TEMP\NM292E.EXE
C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
c:\Program Files\ActivIdentity\ActivClient\acevents.exe
c:\Program Files\Hewlett-Packard\Embedded Security Software\PSDrt.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\shaevans\My Documents\RSIT.exe
C:\Program Files\trend micro\ShaEvans.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.fcintern...efault.asp?ID=2
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://nfuse.czncorp...auth/login.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [IFXSPMGT] c:\WINDOWS\system32\ifxspmgt.exe /NotifyLogon
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoCAD LT Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgentLauncher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res:///3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyds...20Installer.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=58813
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecu...s/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgree...eensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1198010915734
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1227705794549
O16 - DPF: {82B56B47-90DC-4F58-9A7D-D27BA46D3C0F} (MyPhotoAlbum Easy Upload Tool Combo Control) - http://schleppy1975....geUploader4.cab
O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} (MyPhotoAlbum Easy Upload Tool Combo Control) - http://schleppy1975....geUploader4.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://sapience360....bex/ieatgpc.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.pvt
O17 - HKLM\Software\..\Telephony: DomainName = corp.pvt
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.pvt
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.pvt
O20 - AppInit_DLLs: APSHook.dll lmhfhs.dll hubsls.dll
O20 - Winlogon Notify: ackpbsc - c:\WINDOWS\system32\ackpbsc.dll
O20 - Winlogon Notify: acunlock - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll
O20 - Winlogon Notify: DeviceNP - C:\WINDOWS\SYSTEM32\DeviceNP.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
O20 - Winlogon Notify: yayyVopP - C:\WINDOWS\
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CCA Agent Stub (CCAAgentStub) - Unknown owner - C:\WINDOWS\system32\CCAAgentStub.exe (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: HP ProtectTools Device Locking / Auditing (FLCDLOCK) - Hewlett-Packard Ltd - C:\WINDOWS\system32\flcdlock.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - c:\WINDOWS\system32\ifxspmgt.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - c:\WINDOWS\system32\ifxtcs.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: Personal Secure Drive service (PersonalSecureDriveService) - Infineon Technologies AG - c:\WINDOWS\system32\IfxPsdSv.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\AMT\UNS.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 14529 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-26 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll [2008-10-17 652784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-26 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-26 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"atchk"=C:\Program Files\Intel\AMT\atchk.exe [2007-05-01 404248]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-03-01 472776]
"IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2007-10-08 995328]
"IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2007-10-08 1101824]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2006-07-13 729088]
"PTHOSTTR"=c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE [2007-01-09 145184]
"CognizanceTS"=C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll [2003-12-22 17920]
"IFXSPMGT"=c:\WINDOWS\system32\ifxspmgt.exe [2007-02-15 677408]
""= []
"accrdsub"=c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [2007-05-03 293168]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2007-01-05 872448]
"Cpqset"=C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe [2007-01-02 40960]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-05-18 138008]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-05-18 162584]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-05-18 138008]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-11-06 177456]
"Client Access Service"=C:\Program Files\IBM\Client Access\cwbsvstr.exe [2002-05-07 20530]
"Client Access Help Update"=C:\Program Files\IBM\Client Access\cwbinhlp.exe [2002-05-07 24626]
"Client Access Check Version"=C:\Program Files\IBM\Client Access\cwbckver.exe [2002-05-07 45056]
"Client Access Express Welcome"=C:\Program Files\IBM\Client Access\cwbwlwiz.exe [2002-05-07 20530]
"AdaptecDirectCD"=C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe [2002-12-17 684032]
"OfficeScanNT Monitor"=C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe [2008-10-09 709928]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-26 136600]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-10-15 185872]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-10-01 111936]
"Verizon_McciTrayApp"=C:\Program Files\Verizon\McciTrayApp.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-04-30 68856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
AutoCAD LT Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
Clean Access Agent.lnk - C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgentLauncher.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE
Printkey2000.lnk - C:\Program Files\PrintKey2000\Printkey2000.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="APSHook.dll lmhfhs.dll hubsls.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ackpbsc]
c:\WINDOWS\system32\ackpbsc.dll [2007-05-03 112640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acunlock]
c:\Program Files\ActivIdentity\ActivClient\acunlock.dll [2007-05-03 281088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DeviceNP]
C:\WINDOWS\system32\DeviceNP.dll [2007-04-30 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-05-16 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OneCard]
C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [2008-05-13 85504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayyVopP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Wallpaper"=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=1
"legalnoticecaption"=Legal Notice
"legalnoticetext"=This computer system and the data contained herein are property of Frontier Communications. Any unauthorized access and/or use of the data will be investigated and prosecuted to the full extent of the law. This system is to be used for business purposes. All information stored or processed is property of Frontier Communications and is subject to inspection.
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoWelcomeScreen"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\SmartFTP\SmartFTP.exe"="C:\Program Files\SmartFTP\SmartFTP.exe:*:Enabled:SmartFTP"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:conf.exe"
"C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Documents and Settings\mwj974\Local Settings\Temporary Internet Files\Content.IE5\0L6VGXAV\CitrixSAClient[1].exe"="C:\Documents and Settings\mwj974\Local Settings\Temporary Internet Files\Content.IE5\0L6VGXAV\CitrixSAClient[1].exe:*:Enabled:Citrix Secure Access Agent"
"C:\Program Files\NET6\net6vpn.exe"="C:\Program Files\NET6\net6vpn.exe:*:Enabled:Citrix Secure Access Agent"
"C:\WINDOWS\system32\wbem\unsecapp.exe"="C:\WINDOWS\system32\wbem\unsecapp.exe:*:Enabled:WMI"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Citrix\ICA Client\wfica32.exe"="C:\Program Files\Citrix\ICA Client\wfica32.exe:*:Enabled:Citrix ICA Client Engine (Win32)"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:conf.exe"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\SMSADMIN\bin\i386\statview.exe"="C:\SMSADMIN\bin\i386\statview.exe:*:Enabled:SMS 2.0 Utility - Status Message Viewer"
"C:\SMSADMIN\bin\i386\SETUP.EXE"="C:\SMSADMIN\bin\i386\SETUP.EXE:*:Enabled:SMS Setup"
"C:\WINDOWS\system32\wbem\unsecapp.exe"="C:\WINDOWS\system32\wbem\unsecapp.exe:*:Enabled:unsecapp.exe"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\WINDOWS\system32\VoissAssistant.exe"="C:\WINDOWS\system32\VoissAssistant.exe:*:Enabled:VoissAssistant"
"C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\Program Files\NET6\net6vpn.exe"="C:\Program Files\NET6\net6vpn.exe:*:Enabled:Citrix Secure Access Agent"
"C:\Program Files\Java\j2re1.4.2_03\bin\javaw.exe"="C:\Program Files\Java\j2re1.4.2_03\bin\javaw.exe:*:Enabled:javaw"
"C:\Program Files\Viryanet\MicroServer\VCM.exe"="C:\Program Files\Viryanet\MicroServer\VCM.exe:*:Enabled:VCM"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Disabled:Windows Explorer"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Citrix\ICA Client\wfica32.exe"="C:\Program Files\Citrix\ICA Client\wfica32.exe:*:Enabled:Citrix ICA Client Engine (Win32)"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57bd5546-adaa-11dc-bbbe-b02c9a8bec2e}]
shell\AutoRun\command - E:\setup.exe


======File associations======

.reg - open - regedit.exe "%1" %*
.scr - open - "%1" %*

======List of files/folders created in the last 3 months======

2008-11-26 15:32:55 ----D---- C:\rsit
2008-11-26 10:55:49 ----A---- C:\WINDOWS\system32\javaws.exe
2008-11-26 10:55:49 ----A---- C:\WINDOWS\system32\javaw.exe
2008-11-26 10:55:49 ----A---- C:\WINDOWS\system32\java.exe
2008-11-26 10:55:49 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-11-26 10:48:51 ----SHD---- C:\Config.Msi
2008-11-26 10:34:26 ----A---- C:\WINDOWS\system32\sndvol32.exe
2008-11-26 10:15:35 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-26 10:15:28 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-26 10:15:19 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-11-26 10:14:42 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-11-26 09:50:20 ----HDC---- C:\WINDOWS\$NtUninstallKB953761$
2008-11-26 09:46:36 ----D---- C:\Program Files\msn gaming zone
2008-11-26 09:46:27 ----D---- C:\WINDOWS\Prefetch
2008-11-26 09:43:10 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-26 09:43:06 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-26 09:42:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-26 09:42:54 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-26 09:42:46 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2008-11-26 09:42:40 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-26 09:42:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-26 09:42:27 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$
2008-11-26 09:42:21 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-26 09:42:16 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-26 09:42:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-11-26 09:42:06 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-26 09:42:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951618-v2$
2008-11-26 09:41:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-26 09:41:49 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-26 09:41:45 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-26 09:41:40 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-26 09:41:33 ----HDC---- C:\WINDOWS\$NtUninstallKB950759$
2008-11-26 09:41:29 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-26 09:41:25 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-26 09:38:22 ----A---- C:\WINDOWS\system32\msxml6r.dll
2008-11-26 09:38:15 ----N---- C:\WINDOWS\system32\comsdupd.exe
2008-11-26 09:38:11 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2008-11-26 09:38:11 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2008-11-26 09:38:10 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2008-11-26 09:38:10 ----N---- C:\WINDOWS\system32\azroles.dll
2008-11-26 09:38:10 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2008-11-26 09:38:10 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2008-11-26 09:38:10 ----N---- C:\WINDOWS\system32\ati3duag.dll
2008-11-26 09:38:10 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2008-11-26 09:38:10 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\eapolqec.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dot3ui.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dot3svc.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dot3msm.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dot3api.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dimsroam.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2008-11-26 09:38:09 ----N---- C:\WINDOWS\system32\credssp.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\eapsvc.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\eapqec.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\eappprxy.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\eapphost.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\eappgnui.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\eappcfg.dll
2008-11-26 09:38:08 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2008-11-26 09:38:07 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2008-11-26 09:38:07 ----N---- C:\WINDOWS\system32\kmsvc.dll
2008-11-26 09:38:07 ----N---- C:\WINDOWS\system32\kbdpash.dll
2008-11-26 09:38:07 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2008-11-26 09:38:07 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2008-11-26 09:38:07 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2008-11-26 09:38:06 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2008-11-26 09:38:06 ----N---- C:\WINDOWS\system32\mssha.dll
2008-11-26 09:38:06 ----N---- C:\WINDOWS\system32\mmcperf.exe
2008-11-26 09:38:06 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-11-26 09:38:06 ----N---- C:\WINDOWS\system32\mmcex.dll
2008-11-26 09:38:06 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-11-26 09:38:05 ----N---- C:\WINDOWS\system32\napmontr.dll
2008-11-26 09:38:05 ----N---- C:\WINDOWS\system32\napipsec.dll
2008-11-26 09:38:05 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2008-11-26 09:38:04 ----N---- C:\WINDOWS\system32\napstat.exe
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\s3gnb.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\rasqec.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\qutil.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\qcliprov.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\qagentrt.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\qagent.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\onex.dll
2008-11-26 09:38:03 ----N---- C:\WINDOWS\system32\nv4_disp.dll
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\tspkg.dll
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\slserv.exe
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\slrundll.exe
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\slgen.dll
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\slextspk.dll
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\slcoinst.dll
2008-11-26 09:38:02 ----N---- C:\WINDOWS\system32\setupn.exe
2008-11-26 09:38:01 ----N---- C:\WINDOWS\system32\wmphoto.dll
2008-11-26 09:38:01 ----N---- C:\WINDOWS\system32\wlanapi.dll
2008-11-26 09:38:01 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2008-11-26 09:38:00 ----N---- C:\WINDOWS\slrundll.exe
2008-11-26 09:37:59 ----D---- C:\WINDOWS\system32\scripting
2008-11-26 09:37:57 ----D---- C:\WINDOWS\system32\en
2008-11-26 09:37:57 ----D---- C:\WINDOWS\l2schemas
2008-11-26 09:37:56 ----D---- C:\WINDOWS\system32\bits
2008-11-26 09:34:44 ----D---- C:\WINDOWS\ServicePackFiles
2008-11-26 09:32:13 ----D---- C:\WINDOWS\network diagnostic
2008-11-26 09:31:23 ----A---- C:\WINDOWS\003302_.tmp
2008-11-26 09:28:45 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-11-26 09:12:01 ----A---- C:\WindowsXP-KB936929-SP3-x86-ENU.exe
2008-11-26 09:00:49 ----D---- C:\hotfix
2008-11-25 15:45:08 ----D---- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-11-25 10:02:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2008-11-25 10:01:57 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2008-11-25 09:57:18 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2008-11-22 15:47:28 ----ASH---- C:\WINDOWS\system32\mSuuxyay.ini2
2008-11-22 15:47:27 ----ASH---- C:\WINDOWS\system32\mSuuxyay.ini
2008-11-21 08:57:38 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-21 08:57:38 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-20 23:07:52 ----N---- C:\WINDOWS\system32\ltgnycfw.dll
2008-11-20 23:07:12 ----A---- C:\WINDOWS\system32\f30f2094-.txt
2008-11-13 20:05:58 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2008-11-12 13:22:03 ----HDC---- C:\WINDOWS\$NtUninstallKB943729$
2008-11-12 13:21:26 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$
2008-11-12 11:53:30 ----D---- C:\WINDOWS\ie7updates
2008-11-12 08:45:28 ----A---- C:\WINDOWS\cdplayer.ini
2008-11-11 22:36:50 ----D---- C:\WINDOWS\pss
2008-11-11 22:17:27 ----D---- C:\WINDOWS\WBEM
2008-11-11 22:15:49 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2008-11-11 22:15:34 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2008-11-11 22:15:08 ----HDC---- C:\WINDOWS\$NtUninstallKB915865$
2008-11-11 22:14:58 ----N---- C:\WINDOWS\system32\xmllite.dll
2008-11-11 21:59:14 ----A---- C:\WINDOWS\Active Setup Log.txt
2008-11-11 21:59:14 ----A---- C:\WINDOWS\Active Setup Log.BAK
2008-11-09 21:12:47 ----D---- C:\WINDOWS\RegisteredPackages
2008-11-05 12:17:52 ----D---- C:\Documents and Settings\shaevans\Application Data\Thunderbird
2008-11-05 12:17:46 ----D---- C:\Program Files\Mozilla Thunderbird
2008-11-02 18:44:26 ----D---- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-11-02 18:44:25 ----D---- C:\Program Files\Viewpoint
2008-11-02 18:44:18 ----D---- C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-11-02 18:44:18 ----D---- C:\Documents and Settings\All Users\Application Data\AOL
2008-11-02 18:44:01 ----D---- C:\Program Files\Common Files\AOL
2008-10-30 20:52:30 ----D---- C:\Documents and Settings\shaevans\Application Data\Motive
2008-10-30 20:32:40 ----D---- C:\Program Files\Yahoo!
2008-10-30 20:32:18 ----D---- C:\Documents and Settings\All Users\Application Data\Motive
2008-10-30 20:32:08 ----D---- C:\Program Files\Common Files\Motive
2008-10-30 20:24:28 ----D---- C:\WINDOWS\DSL
2008-10-30 20:24:28 ----D---- C:\Program Files\Common Files\SupportSoft
2008-10-30 14:59:07 ----D---- C:\Program Files\Adobe Media Player
2008-10-30 14:59:03 ----D---- C:\Program Files\Common Files\Adobe AIR
2008-10-28 10:57:30 ----D---- C:\Program Files\Bonjour
2008-10-26 16:15:58 ----D---- C:\Documents and Settings\shaevans\Application Data\WinRAR
2008-10-23 21:05:41 ----D---- C:\Program Files\WinRAR
2008-10-22 12:03:25 ----D---- C:\Documents and Settings\shaevans\Application Data\webex
2008-10-20 08:20:14 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2008-10-20 08:20:09 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-20 08:20:04 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$
2008-10-20 08:19:58 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2008-10-20 08:19:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2008-10-20 08:18:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956390_0$
2008-10-15 21:05:14 ----D---- C:\Documents and Settings\shaevans\Application Data\Talkback
2008-10-15 21:03:39 ----D---- C:\Program Files\Common Files\xing shared
2008-10-15 21:03:35 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2008-10-15 21:03:32 ----D---- C:\Program Files\Real
2008-10-15 21:03:32 ----A---- C:\WINDOWS\system32\pndx5032.dll
2008-10-15 21:03:32 ----A---- C:\WINDOWS\system32\pndx5016.dll
2008-10-15 21:03:32 ----A---- C:\WINDOWS\system32\pncrt.dll
2008-10-15 21:03:30 ----D---- C:\Program Files\Common Files\Real
2008-10-15 21:03:29 ----D---- C:\Documents and Settings\shaevans\Application Data\Real
2008-10-15 21:02:57 ----D---- C:\Documents and Settings\shaevans\Application Data\Mozilla
2008-10-15 21:02:54 ----D---- C:\Program Files\Mozilla Firefox
2008-10-14 07:25:14 ----A---- C:\tmuninst.ini
2008-10-14 07:24:41 ----D---- C:\WINDOWS\system32\log
2008-10-13 09:51:22 ----HD---- C:\WINDOWS\system32\GroupPolicy
2008-10-10 14:07:35 ----D---- C:\Documents and Settings\shaevans\Application Data\NCH Swift Sound
2008-10-03 16:40:38 ----D---- C:\Documents and Settings\shaevans\Application Data\DivX
2008-10-03 16:39:23 ----D---- C:\Program Files\DivX
2008-09-22 10:04:02 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$
2008-09-18 07:17:42 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-09-15 19:11:28 ----A---- C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-08-29 09:18:58 ----A---- C:\WINDOWS\system32\dns-sd.exe
2008-08-29 08:53:50 ----A---- C:\WINDOWS\system32\dnssd.dll

======List of files/folders modified in the last 3 months======

2008-11-26 15:33:11 ----D---- C:\Program Files\Trend Micro
2008-11-26 15:32:52 ----D---- C:\WINDOWS\system32
2008-11-26 15:32:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-26 15:29:21 ----D---- C:\WINDOWS\Temp
2008-11-26 15:28:11 ----A---- C:\WINDOWS\system32\log.txt
2008-11-26 15:28:05 ----A---- C:\gina_pre.txt
2008-11-26 15:04:26 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-26 11:35:58 ----A---- C:\WINDOWS\SMSCFG.ini
2008-11-26 11:34:33 ----D---- C:\WINDOWS
2008-11-26 11:26:50 ----HD---- C:\WINDOWS\inf
2008-11-26 11:26:50 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-26 11:26:43 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-26 11:09:14 ----A---- C:\WINDOWS\hpbafd.ini
2008-11-26 10:57:42 ----D---- C:\Program Files\Common Files
2008-11-26 10:55:33 ----SHD---- C:\WINDOWS\Installer
2008-11-26 10:55:29 ----D---- C:\Program Files\Java
2008-11-26 10:50:46 ----RD---- C:\Program Files
2008-11-26 10:50:46 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-11-26 10:50:39 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-11-26 10:50:39 ----D---- C:\WINDOWS\system32\drivers
2008-11-26 10:48:57 ----D---- C:\Program Files\Common Files\Apple
2008-11-26 10:45:29 ----SD---- C:\WINDOWS\Tasks
2008-11-26 10:45:04 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-26 10:38:46 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-26 10:35:33 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-26 10:15:35 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-26 09:46:33 ----A---- C:\WINDOWS\setuplog.txt
2008-11-26 09:45:50 ----RSD---- C:\WINDOWS\Fonts
2008-11-26 09:45:50 ----D---- C:\WINDOWS\system32\wbem
2008-11-26 09:45:50 ----D---- C:\WINDOWS\system32\Setup
2008-11-26 09:45:50 ----D---- C:\WINDOWS\AppPatch
2008-11-26 09:42:03 ----D---- C:\WINDOWS\Help
2008-11-26 09:41:30 ----D---- C:\Program Files\Messenger
2008-11-26 09:41:09 ----D---- C:\WINDOWS\security
2008-11-26 09:40:53 ----D---- C:\WINDOWS\system32\inetsrv
2008-11-26 09:38:28 ----D---- C:\WINDOWS\WinSxS
2008-11-26 09:38:14 ----D---- C:\WINDOWS\ime
2008-11-26 09:38:00 ----D---- C:\WINDOWS\system32\usmt
2008-11-26 09:38:00 ----D---- C:\WINDOWS\system32\en-us
2008-11-26 09:37:57 ----D---- C:\Program Files\Internet Explorer
2008-11-26 09:37:56 ----D---- C:\WINDOWS\PeerNet
2008-11-26 09:37:56 ----D---- C:\Program Files\Movie Maker
2008-11-26 09:34:32 ----D---- C:\WINDOWS\system32\Restore
2008-11-26 09:34:32 ----D---- C:\WINDOWS\system32\npp
2008-11-26 09:34:32 ----D---- C:\WINDOWS\mui
2008-11-26 09:34:30 ----D---- C:\WINDOWS\msagent
2008-11-26 09:34:29 ----D---- C:\WINDOWS\srchasst
2008-11-26 09:34:28 ----D---- C:\Program Files\NetMeeting
2008-11-26 09:34:26 ----D---- C:\WINDOWS\system32\Com
2008-11-26 09:34:23 ----D---- C:\Program Files\Windows Media Player
2008-11-26 09:34:23 ----D---- C:\Program Files\Outlook Express
2008-11-26 09:34:18 ----D---- C:\Program Files\Common Files\System
2008-11-26 09:33:57 ----D---- C:\WINDOWS\system32\oobe
2008-11-26 09:33:56 ----D---- C:\WINDOWS\system
2008-11-26 09:28:43 ----D---- C:\WINDOWS\ehome
2008-11-26 08:38:25 ----D---- C:\WINDOWS\system32\appmgmt
2008-11-26 08:23:18 ----D---- C:\WINDOWS\SoftwareDistribution
2008-11-26 08:20:52 ----D---- C:\Documents and Settings
2008-11-26 08:11:37 ----RASH---- C:\boot.ini
2008-11-26 08:11:37 ----A---- C:\WINDOWS\win.ini
2008-11-26 08:11:37 ----A---- C:\WINDOWS\system.ini
2008-11-26 08:10:13 ----A---- C:\WINDOWS\cfgall.ini
2008-11-25 16:49:50 ----D---- C:\Program Files\NCH Swift Sound
2008-11-25 16:15:46 ----D---- C:\Program Files\Google
2008-11-25 16:15:46 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2008-11-25 14:23:36 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-11-24 22:48:21 ----D---- C:\Program Files\Windows NT
2008-11-22 21:40:52 ----A---- C:\WINDOWS\ntbtlog.txt
2008-11-21 08:54:52 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-19 21:03:32 ----D---- C:\Program Files\Cisco Systems
2008-11-14 15:41:28 ----D---- C:\Program Files\Trillian
2008-11-11 22:17:18 ----D---- C:\WINDOWS\Media
2008-11-08 00:57:07 ----D---- C:\Documents and Settings\shaevans\Application Data\LimeWire
2008-11-07 08:16:45 ----SHD---- C:\WINDOWS\CSC
2008-11-03 19:10:25 ----A---- C:\WINDOWS\system32\MRT.exe
2008-11-02 06:54:14 ----D---- C:\Program Files\Microsoft Silverlight
2008-10-30 20:21:19 ----SD---- C:\Documents and Settings\shaevans\Application Data\Microsoft
2008-10-30 14:59:10 ----D---- C:\Documents and Settings\shaevans\Application Data\Adobe
2008-10-30 14:59:10 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2008-10-24 14:20:44 ----D---- C:\Program Files\ADTRAN DSL Assistant
2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-10-16 14:12:22 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-10-16 14:12:20 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wups2.dll
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\cdm.dll
2008-10-16 14:09:40 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2008-10-16 14:08:58 ----A---- C:\WINDOWS\system32\wups.dll
2008-10-16 14:07:14 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2008-10-15 21:03:32 ----A---- C:\WINDOWS\system32\msvcp71.dll
2008-10-15 11:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-13 09:53:15 ----A---- C:\WINDOWS\ODBC.INI
2008-10-01 11:23:47 ----SHD---- C:\System Volume Information
2008-09-09 20:14:56 ----A---- C:\WINDOWS\system32\msxml6.dll
2008-09-04 12:15:04 ----A---- C:\WINDOWS\system32\msxml3.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 cdudf_xp;cdudf_xp; C:\WINDOWS\system32\drivers\cdudf_xp.sys [2002-12-17 241152]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 PersonalSecureDrive;PersonalSecureDrive; C:\WINDOWS\System32\drivers\psd.sys [2007-01-23 39080]
R1 pwd_2k;pwd_2k; C:\WINDOWS\system32\drivers\pwd_2k.sys [2008-01-02 143834]
R1 tmtdi;Trend Micro TDI Driver; C:\WINDOWS\system32\DRIVERS\tmtdi.sys [2008-10-09 72072]
R1 UdfReadr_xp;UdfReadr_xp; C:\WINDOWS\system32\drivers\UdfReadr_xp.sys [2008-01-02 206464]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-12-19 21361]
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys []
R2 irda;IrDA Protocol; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2007-08-27 12288]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R2 TmFilter;Trend Micro Filter; \??\C:\Program Files\Trend Micro\OfficeScan Client\TmXPFlt.sys []
R2 TmPreFilter;Trend Micro PreFilter; \??\C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys []
R2 VSApiNt;Trend Micro VSAPI NT; \??\C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys []
R3 Accelerometer;Accelerometer; C:\WINDOWS\system32\DRIVERS\Accelerometer.sys [2006-10-17 22016]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-10-01 281600]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2007-07-13 94976]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ATSWPDRV;AuthenTec TruePrint USB Driver (SwipeSensor); C:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys [2007-08-28 146560]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2007-02-14 530861]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2007-02-14 30459]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2007-02-14 868298]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2007-02-14 149123]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2007-02-14 67960]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2007-01-31 127376]
R3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2007-06-19 255896]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys [2007-06-18 16768]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-10-16 989312]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2007-10-16 211200]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-05-16 5707744]
R3 IFXTPM;IFXTPM; C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2007-01-23 36608]
R3 kbstuff;SMS Virtual Input Device; C:\WINDOWS\system32\DRIVERS\kbstuff5.sys [2003-02-23 7744]
R3 NETw4x32;Intel® Wireless WiFi Link Adapter Driver for Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-09-26 2236032]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys

Attached Files

•  kapersky_11_26_2008.html   3.55KB   26 downloads

Edited by schlep, 26 November 2008 - 07:52 PM.