jlp188
Topic Starter
Firstly, thanks for any help. I work for Fedex and my laptop was running just fine until about two weeks ago. Now it may take as long as 30 minutes for the laptop to fully boot to the point that I can use anything. I load Outlook as soon as it seems like the OS is fully loaded and that takes an additional 5 minutes. Screen response and mouse response is extremely slow until about 10 more minutes, and even then the level of machine responsiveness goes up and down. I ran a quick scan with MalwareBytes AntiMalware and found 9 items to quarantine and remove but it did not help anything. I was not able to disable any security programs on my laptop because they are administered remotely across our corporate network and locked down. I would push this issue through our tech support but it usually takes a while and they usually do what I am doing now anyway, but I guess I will if all else fails. Hope you can help me.
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/09/11 12:16
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0x9A012000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBA5D6000 Size: 8192 File Visible: No Signed: -
Status: -
Name: nwfilter.sys
Image Path: nwfilter.sys
Address: 0xBA4C4000 Size: 15808 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0x987C6000 Size: 49152 File Visible: No Signed: -
Status: -
SSDT
——————-
#: 017 Function Name: NtAllocateVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xab198b30
#: 050 Function Name: NtCreateSection
Status: Hooked by "C:\WINDOWS\System32\Drivers\SbPrcCtl.SYS" at address 0xab8ad9b1
#: 053 Function Name: NtCreateThread
Status: Hooked by "" at address 0x87f7a109
#: 108 Function Name: NtMapViewOfSection
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xab198470
#: 137 Function Name: NtProtectVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xab198c50
#: 249 Function Name: NtShutdownSystem
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xab198990
#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xab1988d0
#: 277 Function Name: NtWriteVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\wpsdrvnt.sys" at address 0xab198d60
==EOF==
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 12:18:37.45 on Fri 09/11/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.5.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.365 [GMT -5:00]
FW: Sygate Security Agent *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k eapsvcs
svchost.exe
C:\WINDOWS\system32\ngvpnmgr.exe
C:\Program Files\Funk Software\Odyssey Client\odClientService.exe
C:\WINDOWS\System32\svchost.exe -k dot3svc
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\SafeBoot\SbClientManager.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchostBT.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\SharedComponents\CAM\bin\cam.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\svchost.exe -k HPService
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\CA\DSM\bin\caf.exe
C:\Program Files\CA\DSM\Bin\cfsmsmd.exe
C:\Program Files\CA\DSM\Bin\ccnfagent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\DSM\Bin\cfnotsrvd.exe
C:\Program Files\CA\DSM\Bin\ccsmagtd.exe
C:\Program Files\CA\DSM\Bin\rcHost.exe
C:\Program Files\CA\SC\DTS\bin\tngdta.exe
C:\Program Files\CA\DSM\Bin\amswmagt.exe
C:\Program Files\CA\DSM\PMAgent\capmuamagt.exe
C:\Program Files\CA\DSM\Bin\cfftplugin.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Network Associates\Common Framework\udaterui.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Funk Software\Odyssey Client\OdTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CA\DSM\bin\cfSysTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SafeBoot Tray Manager\SbTrayManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Write DVD!\saimon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SQL Anywhere 10\Sybase Central 5.0.0\win32\scjview.exe
C:\Program Files\SQL Anywhere 10\win32\dbisqlg.exe
C:\Program Files\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe
C:\Program Files\Sybase\SQL Anywhere 9\win32\dbisqlg.exe
C:\Program Files\Volumouse\volumouse.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\681593\Desktop\dds.scr
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uStart Page = hxxp://www.glennbeck.com/content/insider/
uDefault_Page_URL = hxxp://home.fedex.com
mDefault_Page_URL = hxxp://home.fedex.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: IE7Pro BHO: {00011268-e188-40df-a514-835fcd78b1bf} - c:\program files\iepro\iepro.dll
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 8\SnagItBHO.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: OFK System: {a04ee79b-b894-4ce9-ad27-caeba40709a4} - c:\windows\blopenvtdq.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SybaseCentral500] "c:\program files\sql anywhere 10\sybase central 5.0.0\win32\scjview.exe" -preload
uRun: [DBISQL10] "c:\program files\sql anywhere 10\win32\dbisqlg.exe" -preload
uRun: [SybaseCentral43] "c:\program files\sybase\shared\sybase central 4.3\win32\scjview.exe" -preload
uRun: [DBISQL9] "c:\program files\sybase\sql anywhere 9\win32\dbisqlg.exe" -preload
uRun: [$Volumouse$] "c:\program files\volumouse\volumouse.exe" /nodlg
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [The Glenn Beck Program] c:\program files\glenn beck media center\Glenn Beck Media Center.exe
uRun: [Google Update] "c:\documents and settings\681593\local settings\application data\google\update\GoogleUpdate.exe" /c
uRunOnce: [UniblueRegistryBooster] "c:\program files\uniblue\registrybooster 2009\launcher.exe" delay 20000
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
mRun: [ShStatEXE] "c:\program files\network associates\virusscan\SHSTAT.EXE" /STANDALONE
mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\udaterui.exe" /StartedFromRunKey
mRun: [Network Associates Error Reporting Service] "c:\program files\common files\network associates\talkback\tbmon.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [NWTRAY] NWTRAY.EXE
mRun: [SmcService] c:\progra~1\sygate\ssa\smc.exe -startgui
mRun: [OdTray.exe] "c:\program files\funk software\odyssey client\OdTray.exe"
mRun: []
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [CAF_SystemTray] "c:\program files\ca\dsm\bin\cfSysTray.exe"
mRun: [DsmSxplog] "c:\program files\ca\dsm\bin\sxpstub.exe"
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [SafeBootTrayManager] "c:\program files\safeboot tray manager\SbTrayManager.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Write DVD-R!] c:\program files\write dvd!\saimon.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
dRunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monito~1.lnk - c:\program files\apache software foundation\apache2.2\bin\ApacheMonitor.exe
mPolicies-system: CompatibleRUPSecurity = 1 (0x1)
IE: Add to Link Commander collection - c:\program files\link commander\libraries\add_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files\iepro\iepro.dll
IE: {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - {B119EB0C-C021-46CF-85B0-34A760E0D5FE} - c:\program files\iepro\iepro.dll
IE: {0492EC8E-CBD1-4303-BC8B-74A8EC2CED09} - {0492EC8E-CBD1-4303-BC8B-74A8EC2CED09} - c:\progra~1\linkco~1\librar~1\LCLaunch.dll
IE: {4712ACB0-8ABC-4FF1-8485-2FC9E9348542} - {4712ACB0-8ABC-4FF1-8485-2FC9E9348542} - c:\progra~1\linkco~1\librar~1\LCAdd.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: ehr.com\ak-uat
Trusted Zone: turbotax.com
DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab
DPF: {15B782AF-55D8-11D1-B477-006097098764} - hxxps://hrthome.prod.fedex.com/groups/hrtapps/CTMS4/authorware/download/awswaxf.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1194469097563
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1232038315647
DPF: {6E2510E6-BF2D-4C78-9F28-2F5C8760F124} - hxxps://erooms.ehr.com/eRoomSetup/client.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1232038301703
DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxps://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {98C53984-8BF8-4D11-9B1C-C324FCA9CADE} - hxxp://baqaapp.prod.fedex.com:7117/qcbin/Spider90.ocx
DPF: {CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DAF7E6E7-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
DPF: {EAEAD7B4-1CC1-4363-B2B3-4ECB3DD924D2} - hxxp://benpidvr.ebs.fedex.com/EngageWebClient/Public/CommSrvAPIProxy.CAB
Notify: CAF - c:\program files\ca\dsm\bin\cfwlogon.dll
Notify: igfxcui - igfxdev.dll
Notify: OdysseyClient - odyEvent.dll
Notify: rcHostExt - c:\program files\ca\dsm\bin\rcLoginExt.dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 nwv1_0
LSA: Notification Packages = SbNp scecli
============= SERVICES / DRIVERS ===============
R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [2007-10-1 103920]
R0 SBAlg;SBAlg;c:\windows\system32\drivers\SbAlg.sys [2007-7-16 44976]
R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [2007-10-1 6496]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2006-10-5 58464]
R1 RsvLock;RsvLock;c:\windows\system32\drivers\RsvLock.sys [2007-10-1 33328]
R1 saicdr;saicdr;c:\windows\system32\drivers\Saicdr.sys [2009-7-23 52352]
R1 saicdrwup;saicdrwup;c:\windows\system32\drivers\saicdrwup.sys [2009-7-23 3200]
R1 saiudf;saiudf;c:\windows\system32\drivers\Saiudf.sys [2009-7-23 374656]
R1 SbFlop;SbFlop;c:\windows\system32\drivers\SbFlop.sys [2007-10-1 34480]
R1 SbPrcCtl;SbPrcCtl;c:\windows\system32\drivers\SbPrcCtl.sys [2007-10-1 15248]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\test1\VCdRom.sys [2007-11-15 8576]
R2 CA-MessageQueuing;CA Message Queuing Server;c:\program files\ca\sharedcomponents\cam\bin\cam.exe [2007-10-18 147456]
R2 caf;CA DSM r11 Common Application Framework.;c:\program files\ca\dsm\bin\CAF.exe [2009-2-8 188416]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2008-11-10 103744]
R2 McShield;Network Associates McShield;c:\program files\network associates\virusscan\mcshield.exe [2005-8-22 221191]
R2 McTaskManager;Network Associates Task Manager;c:\program files\network associates\virusscan\vstskmgr.exe [2005-8-22 29184]
R2 MsDtsServer;SQL Server Integration Services;c:\program files\microsoft sql server\90\dts\binn\MsDtsSrvr.exe [2008-8-5 205840]
R2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [2008-2-20 218693]
R2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\microsoft sql server\mssql.3\reporting services\reportserver\bin\ReportingServicesService.exe [2008-8-5 16912]
R2 SafeBootClientManager;SafeBoot Client Manager;c:\program files\safeboot\SbClientManager.exe [2007-10-1 380988]
R3 bascfig50wnt;bascfig50wnt;c:\windows\bascfig50wnt.sys [2009-9-11 12304]
R3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2006-10-5 114624]
R3 NgLog;Aventail VPN Logging;c:\windows\system32\drivers\nglog.sys [2008-2-20 25240]
R3 NgVpn;Aventail VPN Adapter;c:\windows\system32\drivers\ngvpn.sys [2008-2-20 77464]
R3 OIDNDIS5;OID NDIS 5.0 Protocol Driver;c:\progra~1\wavelink\avalan~1\enabler\OIDNDIS5.SYS [2007-10-18 13388]
R3 rcSmCard;rcSmCard;c:\windows\system32\drivers\rcSmCard.sys [2007-10-28 26128]
R3 rcVidCap;rcVidCap;c:\windows\system32\drivers\rcVidMpt.sys [2007-10-28 9872]
S3 Apache2.2;Apache2.2;c:\program files\apache software foundation\apache2.2\bin\httpd.exe [2008-12-10 24636]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-4-10 29744]
S3 magaService;Lan Discover Agent;c:\program files\sygate\ssa\maga\Maga.exe [2005-6-6 323658]
S3 NaiAvFilter101;NAI Anti Virus;\Device\NaiAvFilter101.sys –> \Device\NaiAvFilter101.sys [?]
S3 NgFilter;Aventail VPN Filter;c:\windows\system32\drivers\ngfilter.sys [2008-2-20 20632]
S3 NgWfp;Aventail VPN Callout;c:\windows\system32\drivers\ngwfp.sys [2008-2-20 23192]
S3 RCSpyDDML;RCSpyDDML;c:\windows\system32\drivers\RCSpyMP.sys [2005-8-9 14336]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2006-12-2 2805000]
S4 vsdatant;vsdatant; [x]
=============== Created Last 30 ================
2009-09-11 12:02 12,304 ——– c:\windows\bascfig50wnt.sys
2009-09-11 10:11 –d—– c:\docume~1\681593\applic~1\Uniblue
2009-09-11 10:09 –d—– c:\program files\Uniblue
2009-09-10 14:18 –d—– c:\docume~1\681593\applic~1\Malwarebytes
2009-09-10 14:18 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:18 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-10 14:18 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-09-10 14:17 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-09-02 01:44 664 a——- c:\windows\system32\d3d9caps.dat
2009-08-31 23:36 –d—– c:\program files\AKcomApp
2009-08-31 10:02 –d—– c:\documents and settings\681593\Tracing
2009-08-31 09:57 81,736 a——- c:\windows\system32\lmdimon8.dll
2009-08-31 09:56 –d—– c:\docume~1\alluse~1\applic~1\Applications
2009-08-25 09:04 80,896 -c—— c:\windows\system32\dllcache\tlntsess.exe
2009-08-25 09:04 76,288 -c—— c:\windows\system32\dllcache\telnet.exe
2009-08-25 09:04 132,096 -c—— c:\windows\system32\dllcache\wkssvc.dll
2009-08-24 02:39 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx
2009-08-24 02:39 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll
2009-08-24 02:39 204,800 -c—— c:\windows\system32\dllcache\mswebdvd.dll
2009-08-24 02:39 136,192 -c—— c:\windows\system32\dllcache\msv1_0.dll
2009-08-24 02:39 92,928 -c—— c:\windows\system32\dllcache\ksecdd.sys
2009-08-24 02:39 56,832 -c—— c:\windows\system32\dllcache\secur32.dll
2009-08-24 02:39 147,456 -c—— c:\windows\system32\dllcache\schannel.dll
2009-08-24 02:39 54,272 -c—— c:\windows\system32\dllcache\wdigest.dll
2009-08-24 02:39 301,568 -c—— c:\windows\system32\dllcache\kerberos.dll
2009-08-24 02:39 730,112 -c—— c:\windows\system32\dllcache\lsasrv.dll
2009-08-21 11:22 284 a——- c:\windows\mercury.ini
2009-08-21 11:22 –d—– c:\program files\common files\Mercury Interactive
2009-08-21 01:04 58,880 -c—— c:\windows\system32\dllcache\atl.dll
2009-08-21 01:03 84,992 -c—— c:\windows\system32\dllcache\avifil32.dll
2009-08-20 22:26 –d—– c:\docume~1\alluse~1\applic~1\IsolatedStorage
2009-08-19 14:38 –d—– c:\program files\Domain Research Tool
2009-08-19 13:16 –d—– c:\program files\AKcom
==================== Find3M ====================
2009-08-05 04:01 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-07-25 05:23 411,368 a——- c:\windows\system32\deploytk.dll
2009-07-22 17:06 348,160 a——- c:\windows\system32\msvcr71.dll
2009-07-17 14:01 58,880 a——- c:\windows\system32\atl.dll
2009-07-15 11:34 94,816 a——- c:\windows\system32\DecoderG729Aagent.exe
2009-07-15 11:34 90,720 a——- c:\windows\system32\G723DecoderUtil.dll
2009-07-15 11:34 71,776 a——- c:\windows\system32\DecoderG729.dll
2009-07-15 11:34 103,008 a——- c:\windows\system32\DecodeG729ATool.dll
2009-07-15 11:34 71,776 a——- c:\windows\system32\DecoderG723.dll
2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll
2009-06-30 10:02 169 a——- C:\ebaclean.bat
2009-06-29 11:12 827,392 a——- c:\windows\system32\wininet.dll
2009-06-29 11:12 78,336 a——- c:\windows\system32\ieencode.dll
2009-06-29 11:12 17,408 ——– c:\windows\system32\corpol.dll
2009-06-25 03:25 730,112 a——- c:\windows\system32\lsasrv.dll
2009-06-25 03:25 301,568 a——- c:\windows\system32\kerberos.dll
2009-06-25 03:25 147,456 a——- c:\windows\system32\schannel.dll
2009-06-25 03:25 136,192 a——- c:\windows\system32\msv1_0.dll
2009-06-25 03:25 56,832 a——- c:\windows\system32\secur32.dll
2009-06-25 03:25 54,272 a——- c:\windows\system32\wdigest.dll
2009-06-16 09:36 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 09:36 81,920 a——- c:\windows\system32\fontsub.dll
============= FINISH: 12:21:31.10 ===============
