Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

NGINX and Browser Redirects


  • This topic is locked This topic is locked

#1
vvnng

vvnng

    Member

  • Member
  • PipPip
  • 28 posts
Good Morning!

My Chrome and Firefox browsers have been hijacked, as of this morning. When I try to go to the Google homepage, it directs me to a page that states "Welcome to Nginx." When I try to search for a topic on Yahoo, I get redirected to a page that starts with "http://urlseek20.vmn.net". I have also gotten "404 Not Found" errors as well. It started with the Firefox browser, and my system froze when I was running Malwarebytes, TweakNow Reg Cleaner, and Lightspeed Security Agent (company laptop). When I rebooted, my chrome browser was infected as well.

I run Malwarebytes fairly often. Please advise if you can help, and I look forward to your reply in the near future.

The log for the OTL quick scan is pasted below: (I also pasted the extras.txt at the bottom of the log, just in case)

OTL logfile created on: 8/24/2011 11:15:43 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\vng\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.97 Gb Total Physical Memory | 0.93 Gb Available Physical Memory | 47.21% Memory free
3.81 Gb Paging File | 2.05 Gb Available in Paging File | 53.87% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.89 Gb Total Space | 202.48 Gb Free Space | 86.94% Space Free | Partition Type: NTFS

Computer Name: TEACHER011 | User Name: vng | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/08/24 11:13:20 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\vng\Desktop\OTL.exe
PRC - [2011/08/17 05:49:18 | 001,017,912 | ---- | M] (Google Inc.) -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
PRC - [2011/06/09 10:50:40 | 000,662,360 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\SecurityAgent\SecurityAgent.exe
PRC - [2011/06/09 10:50:38 | 000,182,616 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\SecurityAgent\SATray.exe
PRC - [2011/06/09 10:50:36 | 000,678,744 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\SecurityAgent\SAAlert.exe
PRC - [2011/05/11 15:46:54 | 000,568,168 | ---- | M] (DYMO) -- C:\Program Files\mimio\MimioStudio\mimiosys.exe
PRC - [2011/04/15 13:18:06 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe
PRC - [2011/03/15 14:06:08 | 000,232,104 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe
PRC - [2011/02/23 17:14:22 | 003,016,048 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\Aware.exe
PRC - [2011/02/04 17:48:30 | 001,767,792 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Response\DesktopMenu.exe
PRC - [2011/02/04 17:48:28 | 000,033,136 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Response\ResponseSoftwareService.exe
PRC - [2011/02/04 17:48:28 | 000,014,704 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Response\ResponseHardwareService.exe
PRC - [2011/01/25 18:10:42 | 000,846,704 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe
PRC - [2011/01/25 18:10:34 | 013,320,560 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardTools.exe
PRC - [2011/01/25 18:09:44 | 006,665,072 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\Marker.exe
PRC - [2011/01/25 18:09:20 | 005,893,488 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe
PRC - [2010/11/10 10:38:32 | 000,111,960 | ---- | M] (SRS Labs, Inc.) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe
PRC - [2010/09/17 21:14:22 | 000,460,144 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
PRC - [2010/08/27 17:39:22 | 002,178,208 | ---- | M] (Atheros Communications) -- C:\Program Files\Dell Wireless\Bluetooth Suite\BluetoothSuit.exe
PRC - [2010/06/04 15:29:14 | 000,292,208 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apoint.exe
PRC - [2010/05/31 17:57:12 | 000,056,032 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\hidfind.exe
PRC - [2010/05/31 14:17:06 | 000,054,640 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApntEx.exe
PRC - [2010/05/24 16:44:48 | 000,151,552 | ---- | M] (Atheros) -- C:\Program Files\Dell Wireless\Ath_CoexAgent.exe
PRC - [2010/04/15 11:26:44 | 000,447,632 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\IMAccDriver.exe
PRC - [2010/03/10 13:21:58 | 000,326,008 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\PowerAgent\PowerAgent.exe
PRC - [2010/03/10 13:21:58 | 000,171,896 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\PowerAgent\PowerAgentUser.exe
PRC - [2010/02/17 15:34:40 | 000,054,568 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2011/08/17 05:49:17 | 000,400,440 | ---- | M] () -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\13.0.782.215\ppgooglenaclpluginchrome.dll
MOD - [2011/08/17 05:49:15 | 004,118,072 | ---- | M] () -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\13.0.782.215\pdf.dll
MOD - [2011/08/17 05:48:15 | 000,300,088 | ---- | M] () -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\13.0.782.215\Locales\en-US.dll
MOD - [2011/08/17 05:47:49 | 000,104,520 | ---- | M] () -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\13.0.782.215\avutil-50.dll
MOD - [2011/08/17 05:47:48 | 000,203,848 | ---- | M] () -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\13.0.782.215\avformat-52.dll
MOD - [2011/08/17 05:47:47 | 001,846,344 | ---- | M] () -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\13.0.782.215\avcodec-52.dll
MOD - [2011/08/17 03:49:17 | 006,338,720 | ---- | M] () -- C:\Documents and Settings\vng\Local Settings\Application Data\Google\Chrome\Application\13.0.782.215\gcswf32.dll
MOD - [2011/05/11 15:46:50 | 000,914,432 | ---- | M] () -- C:\Program Files\mimio\MimioStudio\system\gui_multimedia\js32.dll
MOD - [2011/02/04 17:49:46 | 000,463,728 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\ziparchive-vc100-3_1_1.dll
MOD - [2011/02/04 17:17:36 | 000,047,104 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\boost_thread-vc100-mt-1_44.dll
MOD - [2011/02/04 17:14:44 | 002,358,784 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\xqilla-vc100-1_0.dll
MOD - [2011/02/04 17:14:42 | 001,019,904 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\js32.dll
MOD - [2011/02/04 17:14:40 | 002,304,000 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\redland-vc100-1_0_9.dll
MOD - [2011/02/04 17:14:40 | 000,187,904 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\zlib-vc100-1_2_5.dll
MOD - [2011/01/25 18:15:40 | 000,571,248 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\ZipArchive.dll
MOD - [2010/11/01 12:58:18 | 007,540,224 | ---- | M] () -- C:\Program Files\Common Files\SMART Technologies\Qt 4.5.3 vs2010\QtGui4.dll
MOD - [2010/11/01 12:58:18 | 002,021,376 | ---- | M] () -- C:\Program Files\Common Files\SMART Technologies\Qt 4.5.3 vs2010\QtCore4.dll
MOD - [2010/10/12 10:48:34 | 000,877,056 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\QtNetwork4.dll
MOD - [2010/10/12 10:48:24 | 007,462,912 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\QtGui4.dll
MOD - [2010/10/12 10:48:22 | 002,011,648 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\QtCore4.dll
MOD - [2010/09/17 21:14:22 | 000,460,144 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
MOD - [2010/09/17 21:13:36 | 002,826,240 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\Core.dll
MOD - [2010/09/17 21:07:18 | 000,733,184 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\qca2.dll
MOD - [2010/08/27 17:39:20 | 000,012,448 | ---- | M] () -- C:\Program Files\Dell Wireless\Bluetooth Suite\athr_debug.dll
MOD - [2010/08/10 00:01:06 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2010/08/03 16:47:12 | 008,351,744 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtGui4.dll
MOD - [2010/08/03 16:47:12 | 002,244,608 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtCore4.dll
MOD - [2010/08/03 16:47:12 | 000,978,944 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtNetwork4.dll
MOD - [2010/08/03 16:47:12 | 000,364,544 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtXml4.dll
MOD - [2010/08/03 16:47:12 | 000,204,800 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtSql4.dll
MOD - [2010/04/15 11:26:44 | 000,447,632 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\IMAccDriver.exe
MOD - [2010/04/07 16:34:08 | 002,079,232 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\QtCore4.dll
MOD - [2010/04/07 16:34:06 | 007,738,368 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\QtGui4.dll
MOD - [2010/04/06 21:15:28 | 000,027,136 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\imageformats\qico4.dll
MOD - [2008/04/14 08:00:00 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2008/04/14 08:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/06/09 10:50:40 | 000,662,360 | ---- | M] (Lightspeed Systems) [Auto | Running] -- C:\Program Files\Lightspeed Systems\SecurityAgent\SecurityAgent.exe -- (IpmSecurityAgentService)
SRV - [2011/04/15 13:18:06 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) [Auto | Running] -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe -- (RosettaStoneDaemon)
SRV - [2011/02/04 17:48:28 | 000,014,704 | ---- | M] (SMART Technologies) [Auto | Running] -- C:\Program Files\SMART Technologies\SMART Response\ResponseHardwareService.exe -- (Response Hardware)
SRV - [2011/01/25 18:13:16 | 001,678,704 | ---- | M] (SMART Technologies ULC) [On_Demand | Stopped] -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe -- (SMART SNMP Agent Service)
SRV - [2011/01/25 18:10:42 | 000,846,704 | ---- | M] (SMART Technologies ULC) [Auto | Running] -- C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe -- (SMART Display Controller)
SRV - [2011/01/25 18:09:20 | 005,893,488 | ---- | M] (SMART Technologies) [Auto | Running] -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe -- (SMART Board Service)
SRV - [2010/11/10 10:38:32 | 000,111,960 | ---- | M] (SRS Labs, Inc.) [Auto | Running] -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe -- (SRS_VolSync_Service)
SRV - [2010/09/17 21:14:22 | 000,460,144 | ---- | M] () [Auto | Running] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2010/05/24 16:44:48 | 000,151,552 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files\Dell Wireless\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent)
SRV - [2010/03/10 13:21:58 | 000,326,008 | ---- | M] (Lightspeed Systems) [Auto | Running] -- C:\Program Files\Lightspeed Systems\PowerAgent\PowerAgent.exe -- (PowerAgentService)


========== Driver Services (SafeList) ==========

DRV - [2011/06/09 10:31:06 | 000,177,760 | ---- | M] (Lightspeed Systems) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\SaFsFilter.sys -- (SAFsFilter)
DRV - [2011/06/09 10:29:12 | 000,040,032 | ---- | M] (Lightspeed Systems) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\IpmSecurityAgent1.sys -- (IpmSecurityAgent1)
DRV - [2010/09/27 09:53:52 | 000,384,800 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SRS_PremiumSound_i386.sys -- (SRS_PremiumSound_Service)
DRV - [2010/09/06 11:32:42 | 000,641,312 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathprot.sys -- (BTATHPROT)
DRV - [2010/09/06 11:32:42 | 000,071,968 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathusb.sys -- (BTATHUSB)
DRV - [2010/08/27 17:39:26 | 000,085,152 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathspp.sys -- (btathspp)
DRV - [2010/08/27 17:39:26 | 000,027,040 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathsco.sys -- (Atheros_btAudio)
DRV - [2010/08/27 17:39:26 | 000,012,832 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathrcp.sys -- (btathrcp)
DRV - [2010/08/27 17:39:24 | 000,072,864 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btatha2dp.sys -- (btatha2dp)
DRV - [2010/08/27 17:39:24 | 000,036,256 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathpan.sys -- (btathPan)
DRV - [2010/08/25 14:22:26 | 001,938,048 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAU32.sys -- (CnxtHdAudService)
DRV - [2010/08/06 04:45:52 | 000,069,008 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\silabser.sys -- (silabser)
DRV - [2010/08/06 04:45:52 | 000,049,040 | ---- | M] (Silicon Laboratories, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\silabenm.sys -- (silabenm)
DRV - [2010/07/01 13:25:22 | 001,693,696 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2010/06/21 21:59:30 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/05/10 10:47:12 | 000,217,016 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2010/05/10 10:47:08 | 000,993,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2010/05/10 10:47:04 | 000,738,360 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2010/02/05 15:16:06 | 000,030,208 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LumensAV.sys -- (LumensCamera)
DRV - [2009/11/27 15:20:06 | 000,177,152 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2009/03/30 19:40:00 | 000,048,640 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\risdpe86.sys -- (risdpcie)
DRV - [2009/03/13 16:32:18 | 001,759,616 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2009/02/12 14:43:00 | 000,045,056 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimspe86.sys -- (rimspci)
DRV - [2008/11/16 19:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 22 69 FD E6 D6 5E CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.775: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.775: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.775: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\vng\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\vng\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\vng\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\vng\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\AutocompletePro\[email protected] [2011/05/13 13:49:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\Firefox [2011/06/07 11:38:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/06/13 12:31:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/24 09:49:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/23 12:08:25 | 000,000,000 | ---D | M]

[2011/06/23 13:50:40 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\vng\Application Data\Mozilla\Extensions
[2011/05/11 13:11:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/06 15:52:07 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/03/02 15:10:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/05/11 11:52:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) --
[2010/09/15 18:25:04 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/01/24 12:34:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/08/24 09:49:17 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/04/14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2007/03/09 19:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/06/07 11:40:15 | 000,002,073 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\completebartb.xml

O1 HOSTS File: ([2008/04/14 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (Complete Bar) - {64c54209-175c-454d-9291-ac46d4d952cf} - C:\Program Files\completebartb\completebarDx.dll ()
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (TODO: <Company name>)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (Complitly) - {D27FC31C-6E3D-4305-8D53-ACDAEFA5F862} - C:\Documents and Settings\Administrator.ICS1\Application Data\ComplitlyEngine\ComplitlyEngine.dll (SimplyGen)
O2 - BHO: (Updater For Complete Bar) - {fe618700-e0ee-441e-8b1d-18ce226bb193} - C:\Program Files\completebartb\auxi\completebarAu.dll (Visicom Media)
O3 - HKLM\..\Toolbar: (Complete Bar) - {64c54209-175c-454d-9291-ac46d4d952cf} - C:\Program Files\completebartb\completebarDx.dll ()
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [AtherosBtXpStack] C:\Program Files\Dell Wireless\Bluetooth Suite\BluetoothSuit.exe (Atheros Communications)
O4 - HKLM..\Run: [SecurityAgentTray] C:\Program Files\Lightspeed Systems\SecurityAgent\SATray.exe (Lightspeed Systems)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Menu.lnk = C:\Program Files\SMART Technologies\SMART Response\DesktopMenu.exe (SMART Technologies)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\IMAccDriver.lnk = C:\Program Files\ELMO\Image Mate Accent\IMAccDriver.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MimioStudio.lnk = C:\Program Files\mimio\MimioStudio\mimiosys.exe (DYMO)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMART Board Tools.lnk = C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardTools.exe (SMART Technologies ULC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (TODO: <Company name>)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1284586548288 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.237.161.12
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ICS1.local
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\dell.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\dell.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/11 18:18:09 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/24 11:13:19 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\vng\Desktop\OTL.exe
[2011/08/24 10:19:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\TweakNow RegCleaner
[2011/08/21 20:43:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Science PSSA
[2011/08/19 22:12:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations
[2011/08/19 22:06:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ExamView Pro Test Generator
[2011/08/19 22:06:42 | 000,000,000 | ---D | C] -- C:\ExamView
[2011/08/19 21:24:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Math Procedures Textbook
[2011/08/19 21:18:25 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\vng\IECompatCache
[2011/08/19 21:17:18 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\vng\PrivacIE
[2011/08/19 21:03:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\Malwarebytes
[2011/08/19 20:59:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Shortcuts
[2011/08/19 20:58:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Prentice Hall TeacherExpress
[2011/08/19 20:57:46 | 000,661,504 | ---- | C] (APEX Software Corporation) -- C:\WINDOWS\System32\tdbg5.ocx
[2011/08/19 20:57:46 | 000,484,128 | ---- | C] (Sheridan Software Systems, Inc.) -- C:\WINDOWS\System32\SSCALA32.OCX
[2011/08/19 20:57:46 | 000,291,848 | ---- | C] (ProtoView Development Corp.) -- C:\WINDOWS\System32\pvtreex.ocx
[2011/08/19 20:57:46 | 000,043,008 | ---- | C] (Prentice Hall) -- C:\WINDOWS\System32\QIWeekViewCell.ocx
[2011/08/19 20:57:45 | 000,526,856 | ---- | C] (FarPoint Technologies, Inc.) -- C:\WINDOWS\System32\Cal32x20.ocx
[2011/08/19 20:57:45 | 000,400,376 | ---- | C] (FarPoint Technologies, Inc.) -- C:\WINDOWS\System32\Flp32x20.ocx
[2011/08/19 20:57:45 | 000,393,216 | ---- | C] (ProtoView Development Corp.) -- C:\WINDOWS\System32\PVShared.dll
[2011/08/19 20:57:45 | 000,105,984 | ---- | C] (Seagate Software Information Management Group, Inc.) -- C:\WINDOWS\System32\P2BDAO.DLL
[2011/08/19 20:57:45 | 000,067,584 | ---- | C] (Quebecor Interactive) -- C:\WINDOWS\System32\PETree.ocx
[2011/08/19 20:57:45 | 000,056,832 | ---- | C] (Quebecor Interactive) -- C:\WINDOWS\System32\PETab.ocx
[2011/08/19 20:57:45 | 000,043,008 | ---- | C] (Intellia) -- C:\WINDOWS\System32\ICell.ocx
[2011/08/19 20:57:44 | 000,991,476 | ---- | C] (Seagate Software, Inc.) -- C:\WINDOWS\System32\CRYSTL32.OCX
[2011/08/19 20:57:43 | 003,572,224 | ---- | C] (Seagate Software Information Management Group, Inc.) -- C:\WINDOWS\System32\CRPE32.DLL
[2011/08/19 20:57:42 | 000,183,296 | ---- | C] (Seagate Software, Information Management Group, Inc.) -- C:\WINDOWS\System32\crpaig32.dll
[2011/08/19 20:57:42 | 000,056,320 | ---- | C] (Intellia) -- C:\WINDOWS\System32\ITab.ocx
[2011/08/19 20:57:41 | 000,067,072 | ---- | C] (Intellia) -- C:\WINDOWS\System32\ITree.ocx
[2011/08/19 20:57:40 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\IMPLODE.DLL
[2011/08/19 20:57:38 | 000,000,000 | ---D | C] -- C:\Program Files\Prentice Hall
[2011/08/19 20:57:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\WINDOWS
[2011/08/19 20:57:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\Inspiration Software
[2011/08/19 20:16:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\vlc
[2011/08/18 10:16:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\FlipShare Data
[2011/08/17 20:24:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\ICS 2010-11
[2011/08/17 20:24:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Resume
[2011/08/17 20:24:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\25 Quick Formative Assessments for a Differentiated Classroom
[2011/08/15 14:57:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Local Settings\Application Data\Identities
[2010/09/11 19:27:52 | 000,196,608 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010/09/11 19:27:50 | 000,225,280 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/24 11:18:00 | 000,963,148 | ---- | M] () -- C:\WINDOWS\System32\drivers\FileIntegrity
[2011/08/24 11:13:20 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\vng\Desktop\OTL.exe
[2011/08/24 11:05:00 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1598462591-3747913773-3001106356-500UA.job
[2011/08/24 11:05:00 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1598462591-3747913773-3001106356-500Core.job
[2011/08/24 10:50:17 | 000,001,020 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-500UA.job
[2011/08/24 10:30:29 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-4711UA.job
[2011/08/24 10:30:29 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cc592ebc3e23a.job
[2011/08/24 10:26:13 | 000,001,017 | ---- | M] () -- C:\Documents and Settings\vng\bmarchive.bms
[2011/08/24 10:25:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/08/24 10:25:46 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc592eb1838ea.job
[2011/08/24 10:25:46 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-1383384898-1343024091-500.job
[2011/08/24 10:25:04 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/08/24 10:24:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/23 17:31:22 | 000,501,510 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/08/23 17:31:22 | 000,087,354 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/08/23 17:29:57 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/08/23 16:30:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-4711Core.job
[2011/08/23 11:50:02 | 000,000,968 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-500Core.job
[2011/08/20 19:00:44 | 000,341,032 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/08/19 22:15:31 | 001,325,383 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\Science Energizers.pdf
[2011/08/19 22:10:33 | 000,002,104 | ---- | M] () -- C:\Documents and Settings\vng\Application Data\evpro32.prf
[2011/08/19 21:15:49 | 000,938,334 | ---- | M] () -- C:\WINDOWS\System32\drivers\FileIntegrity.bak1
[2011/08/17 17:44:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/15 15:51:35 | 000,077,139 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\CommitLetter-1.pdf
[2011/08/15 15:51:19 | 000,280,348 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\AdminLetter.pdf
[2011/08/15 14:23:30 | 000,293,312 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\Geology_Really_Rocks_Teacher_guide.pdf
[2011/08/15 11:15:54 | 000,289,514 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\Academic_Standards_for_Science_and_Technology_and_Engineering_Education_(Elementary).pdf
[2011/08/15 10:44:49 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/19 22:15:37 | 001,325,383 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\Science Energizers.pdf
[2011/08/19 22:10:33 | 000,002,104 | ---- | C] () -- C:\Documents and Settings\vng\Application Data\evpro32.prf
[2011/08/19 20:57:52 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
[2011/08/19 20:57:52 | 000,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
[2011/08/15 15:51:36 | 000,077,139 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\CommitLetter-1.pdf
[2011/08/15 15:51:21 | 000,280,348 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\AdminLetter.pdf
[2011/08/15 14:23:34 | 000,293,312 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\Geology_Really_Rocks_Teacher_guide.pdf
[2011/08/15 11:15:54 | 000,289,514 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\Academic_Standards_for_Science_and_Technology_and_Engineering_Education_(Elementary).pdf
[2011/08/12 16:25:58 | 000,000,886 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cc592ebc3e23a.job
[2011/08/12 16:25:57 | 000,000,882 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc592eb1838ea.job
[2011/06/13 18:13:39 | 000,246,804 | ---- | C] () -- C:\WINDOWS\System32\AtherosBT.bin
[2011/06/13 16:32:46 | 000,384,800 | R--- | C] () -- C:\WINDOWS\System32\drivers\SRS_PremiumSound_i386.sys
[2011/06/07 11:43:13 | 000,181,360 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/05/11 15:47:22 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\mimio_printer_resource.dll
[2011/05/04 15:30:50 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/03/18 10:50:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2011/01/25 12:26:17 | 024,514,448 | ---- | C] () -- C:\WINDOWS\System32\drivers\FileMD5.dat
[2010/09/18 09:05:30 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/09/16 09:05:23 | 000,000,053 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2010/09/16 09:05:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2010/09/15 23:05:18 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/15 20:49:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/09/15 19:23:38 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/09/15 18:32:00 | 068,341,708 | ---- | C] () -- C:\WINDOWS\System32\drivers\FileID.dat
[2010/09/15 18:32:00 | 068,341,670 | ---- | C] () -- C:\WINDOWS\System32\drivers\FileID.dat.bak
[2010/09/15 18:30:34 | 000,000,410 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010/09/11 19:27:52 | 001,759,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2010/09/11 19:27:52 | 000,028,544 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010/09/11 19:27:52 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2010/09/11 19:24:36 | 000,982,192 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2010/09/11 19:24:35 | 000,417,344 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2010/09/11 19:21:29 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010/09/11 18:19:58 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/09/11 18:15:19 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/09/11 14:07:49 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/09/11 14:06:50 | 000,341,032 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/29 17:22:30 | 000,246,804 | ---- | C] () -- C:\WINDOWS\System32\drivers\AtherosBt.bin
[2008/04/14 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 08:00:00 | 000,501,510 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/14 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 08:00:00 | 000,087,354 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/14 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/03/13 23:53:22 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\JPeg32.dll
[2007/03/15 11:47:48 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\BuEResNT.dll
[2005/04/15 12:52:33 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/04/15 12:52:33 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2011/06/07 11:40:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor
[2010/09/16 09:19:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund
[2011/01/22 14:22:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2011/06/16 14:59:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Flip Video
[2010/09/15 23:27:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ReadNaturally
[2011/06/16 14:40:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RosettaStoneLtdServices
[2011/01/22 14:11:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SMART Technologies
[2011/05/11 16:13:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i
[2010/09/15 20:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/06/23 12:57:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\completebartb
[2011/08/19 20:57:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\Inspiration Software
[2011/06/23 12:55:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\mimio
[2011/06/23 12:56:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\SMART Technologies
[2011/06/23 12:56:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\SMART Technologies Inc
[2011/08/24 10:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\TweakNow RegCleaner

========== Purity Check ==========



< End of report >




OTL Extras logfile created on: 8/24/2011 11:16:18 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\vng\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.97 Gb Total Physical Memory | 0.93 Gb Available Physical Memory | 47.21% Memory free
3.81 Gb Paging File | 2.05 Gb Available in Paging File | 53.87% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.89 Gb Total Space | 202.48 Gb Free Space | 86.94% Space Free | Partition Type: NTFS

Computer Name: TEACHER011 | User Name: vng | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"1305:TCP" = 1305:TCP:*:Enabled:Lightspeed Security Agent (TCP)
"1304:TCP" = 1304:TCP:*:Enabled:Lightspeed Security Agent (TCP1304)
"1305:UDP" = 1305:UDP:*:Enabled:Lightspeed Security Agent (UDP)
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"1305:TCP" = 1305:TCP:*:Enabled:Lightspeed Security Agent (TCP)
"1304:TCP" = 1304:TCP:*:Enabled:Lightspeed Security Agent (TCP1304)
"1305:UDP" = 1305:UDP:*:Enabled:Lightspeed Security Agent (UDP)

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdServices.exe" = C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdServices.exe:127.0.0.1/255.255.255.255:Enabled:Rosetta Stone Ltd Services -- (Rosetta Stone Ltd.)
"C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe" = C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe:127.0.0.1/255.255.255.255:Enabled:Rosetta Stone Daemon -- (Rosetta Stone Ltd.)
"C:\Program Files\SMART Technologies\SMART Product Drivers\UCGui.exe" = C:\Program Files\SMART Technologies\SMART Product Drivers\UCGui.exe:*:Enabled:SMART Universal Controller Interface -- (SMART Technologies ULC)
"C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe" = C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe:*:Enabled:SMART SNMPAgent -- (SMART Technologies ULC)
"C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe" = C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe:*:Enabled:SMART Universal Controller Service -- (SMART Technologies ULC)
"C:\Program Files\SMART Technologies\SMART Response\ResponseSoftwareService.exe" = C:\Program Files\SMART Technologies\SMART Response\ResponseSoftwareService.exe:*:Enabled:SMART Response Software Service -- (SMART Technologies)
"C:\Program Files\completebartb\dtUser.exe" = C:\Program Files\completebartb\dtUser.exe:*:Enabled:Complete Bar DTX Broker -- (Visicom Media Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVC.exe" = C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVC.exe:*:Enabled:SonicWALL Global VPN Client
"C:\Program Files\SMART Technologies\SMART Response\ResponseSoftwareService.exe" = C:\Program Files\SMART Technologies\SMART Response\ResponseSoftwareService.exe:*:Enabled:SMART Response Software Service -- (SMART Technologies)
"C:\Program Files\SMART Technologies\SMART Product Drivers\UCGui.exe" = C:\Program Files\SMART Technologies\SMART Product Drivers\UCGui.exe:*:Enabled:SMART Universal Controller Interface -- (SMART Technologies ULC)
"C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe" = C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe:*:Enabled:SMART SNMPAgent -- (SMART Technologies ULC)
"C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe" = C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe:*:Enabled:SMART Universal Controller Service -- (SMART Technologies ULC)
"C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdServices.exe" = C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdServices.exe:127.0.0.1/255.255.255.255:Enabled:Rosetta Stone Ltd Services -- (Rosetta Stone Ltd.)
"C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe" = C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe:127.0.0.1/255.255.255.255:Enabled:Rosetta Stone Daemon -- (Rosetta Stone Ltd.)
"C:\Documents and Settings\vng\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\vng\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
" PH Math Course 3" = PH Math Course 3
"_{53A908D4-99C6-469B-BC13-F4189F260742}" = Corel Painter Essentials 4
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 25
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Dell WLAN and Bluetooth Client Installation
"{28B0F39B-C0C6-4CC5-902B-9BF20111804C}" = Bluetooth XP Suite
"{2AD738DC-FC24-4342-A2DA-BB6DCCF6B048}" = Jing
"{2B818257-E6C7-4841-8C29-C5C9A982BCE5}" = RICOH R5U241 / R5C847 Media Driver ver.2.04.01.00
"{3350D234-BF06-4ED2-AF14-4C79819D9FAD}" = Image Mate Accent
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Integrated Webcam
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{423799F1-0BD5-4B2D-8BD6-2A49BCEA583B}" = Atheros Wireless LAN Client Adapter
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{46060AEE-3DC2-4256-BD1C-4313DD0767C6}" = SRS Premium Sound
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CE6C6E8-0DAD-4757-86ED-7FB4035BA98B}" = SMART Product Drivers
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{53A908D4-99C6-469B-BC13-F4189F260742}" = Corel Painter Essentials 4
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5F9ABC91-F485-4E34-BA0A-357298B71D04}" = Lightspeed Security Agent v8.00 (x86)
"{67D15B01-9A6B-0397-002A-D2A015212748}" = FlipShare
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{798B6E84-5F20-41A2-8879-7489A314A7DA}" = Image Mate
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B4CE9CA-ECB7-47D1-845E-E1167FFB3F1B}" = SMART Response Software
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91190409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Publisher 2003
"{9550F8A6-3D21-4544-8B87-F9FE7E01B964}" = SMART Notebook
"{978A47F7-B01C-4E6B-8ED7-9C48DA5ED5D9}" = MyScript HWR (Arabic)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.2
"{A238CB67-83E3-44D9-82CF-CDEFC820B009}" = MimioStudio
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7E19604-93AF-4611-8C9F-CE509C2B286F}_is1" = Free YouTube Downloader 3.2.79
"{A89DEBCA-F743-3412-97F6-B2E489194551}" = Google Talk Plugin
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9FE59F0-5BFA-4FDF-84C6-F45457715379}" = InstallIQ Updater
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B700113B-24A8-4D4C-8484-0CC944F764C8}" = Google SketchUp 8
"{B95B1BA9-F887-4B3C-8D3A-CCD4C4675120}" = Microsoft Default Manager
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6B5B017-7643-46A5-AC4D-E58A7B4798A0}" = iTunes
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E0F940B2-26F4-4397-928C-436EFA6937F0}" = Lightspeed PowerAgent v1.00.05
"{E21DA178-9FB0-4F91-B79C-5A6DDEEBFB8D}" = Bing Bar Platform
"{E32661E0-A745-48A5-A9B9-073FDC6B119C}" = Text to Speech XP
"{EDAC6E0D-F93B-4B80-9377-F57D3BB5E6B1}" = MyScript HWR (Spanish)
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FFF186B6-4D02-4D8D-A776-C43E062E01A9}" = Rosetta Stone Ltd Services
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Anti-phishing Domain Advisor" = Anti-phishing Domain Advisor
"Audacity_is1" = Audacity 1.2.6
"AutocompletePro2_is1" = AutocompletePro
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"completebartb" = Complete Bar
"ComplitlyEngine_is1" = ComplitlyEngine
"Cool Timer_is1" = Cool Timer 3.7
"ExamView Pro" = ExamView Pro
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"Inspiration 8" = Inspiration 8
"InterActual Player" = InterActual Player
"IrfanView" = IrfanView (remove only)
"Kidspiration 3" = Kidspiration 3
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mavis Beacon Teaches Typing Deluxe 17" = Mavis Beacon Teaches Typing Deluxe 17
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 6.0 (x86 en-US)" = Mozilla Firefox 6.0 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"Power MP3 WMA Converter(Freeware version)_is1" = Power MP3 WMA Converter 2011, (ver 6.1)
"Read Naturally Client" = Read Naturally SE Network Plus Client
"RealPlayer 12.0" = RealPlayer
"SAII" = Conexant SmartAudio
"Scratch" = Scratch
"Scribus 1.3.3.13" = Scribus 1.3.3.13
"TweakNow RegCleaner_is1" = TweakNow RegCleaner
"VLC media player" = VLC media player 1.1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Widget Engine" = Yahoo! Widgets
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/24/2011 9:40:27 AM | Computer Name = TEACHER011 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 8/24/2011 9:40:45 AM | Computer Name = TEACHER011 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 8/24/2011 9:41:55 AM | Computer Name = TEACHER011 | Source = UserInit | ID = 1000
Description = Could not execute the following script icslogon.bat. The system cannot
find the file specified. .

Error - 8/24/2011 10:20:31 AM | Computer Name = TEACHER011 | Source = Application Error | ID = 1000
Description = Faulting application regcleaner.exe, version 0.0.0.0, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 8/24/2011 10:25:07 AM | Computer Name = TEACHER011 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 8/24/2011 10:25:09 AM | Computer Name = TEACHER011 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 8/24/2011 10:25:10 AM | Computer Name = TEACHER011 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 8/24/2011 10:26:19 AM | Computer Name = TEACHER011 | Source = UserInit | ID = 1000
Description = Could not execute the following script icslogon.bat. The system cannot
find the file specified. .

Error - 8/24/2011 11:15:30 AM | Computer Name = TEACHER011 | Source = Application Hang | ID = 1002
Description = Hanging application OTL.exe, version 3.2.26.5, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/24/2011 11:15:36 AM | Computer Name = TEACHER011 | Source = Application Hang | ID = 1001
Description = Fault bucket -1727272432.

[ System Events ]
Error - 8/23/2011 10:54:38 PM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 120 minutes. NtpClient has no source of accurate
time.

Error - 8/24/2011 9:40:25 AM | Computer Name = TEACHER011 | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain ICS1 due to the following:
%%1311. Make sure that the computer is connected to the network and try again. If
the problem persists, please contact your domain administrator.

Error - 8/24/2011 9:40:27 AM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 8/24/2011 9:40:28 AM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 8/24/2011 9:55:43 AM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.

Error - 8/24/2011 10:25:07 AM | Computer Name = TEACHER011 | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain ICS1 due to the following:
%%1311. Make sure that the computer is connected to the network and try again. If
the problem persists, please contact your domain administrator.

Error - 8/24/2011 10:25:45 AM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 8/24/2011 10:25:46 AM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 8/24/2011 10:40:46 AM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.

Error - 8/24/2011 11:10:49 AM | Computer Name = TEACHER011 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 60 minutes. NtpClient has no source of accurate
time.


< End of report >

Edited by vvnng, 24 August 2011 - 09:22 AM.

  • 0

Advertisements


#2
Gammo

Gammo

    Trusted Helper

  • Malware Removal
  • 2,299 posts
Hi,

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\AutocompletePro\[email protected] [2011/05/13 13:49:23 | 000,000,000 | ---D | M]
    [2011/06/07 11:40:15 | 000,002,073 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\completebartb.xml
    O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll (SimplyGen)
    O2 - BHO: (Complete Bar) - {64c54209-175c-454d-9291-ac46d4d952cf} - C:\Program Files\completebartb\completebarDx.dll ()
    O2 - BHO: (Complitly) - {D27FC31C-6E3D-4305-8D53-ACDAEFA5F862} - C:\Documents and Settings\Administrator.ICS1\Application Data\ComplitlyEngine\ComplitlyEngine.dll (SimplyGen)
    O2 - BHO: (Updater For Complete Bar) - {fe618700-e0ee-441e-8b1d-18ce226bb193} - C:\Program Files\completebartb\auxi\completebarAu.dll (Visicom Media)
    O3 - HKLM\..\Toolbar: (Complete Bar) - {64c54209-175c-454d-9291-ac46d4d952cf} - C:\Program Files\completebartb\completebarDx.dll ()
    [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [2011/05/11 16:13:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i
    [2011/06/23 12:57:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\completebartb
    
    :Services
    
    :Reg
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\completebartb\dtUser.exe"=-
    
    :Files
    ipconfig /flushdns /c
    C:\Program Files\AutocompletePro
    C:\Program Files\completebartb
    C:\Documents and Settings\Administrator.ICS1\Application Data\ComplitlyEngine
    
    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [emptyflash]
    [createrestorepoint]
    [reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done





Download and Install Combofix

Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks

    Posted Image

    Posted Image
  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now
  • 0

#3
vvnng

vvnng

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
Unfortunately, I was unable to run ComboFix. I had turned off the anti-virus scan (lightspeed security agent). The first time I ran the program, my computer froze. The next 2 times, the computer did not complete the scan, and appeared not to be working properly. For example, the ComboFix window drags and leaves outlines when I attempt to move the window.

Since this is a company laptop, I currently do not have access to the "my documents" folder until I am on the network. I will not be on the network until Monday.

Please advise how I should proceed. I can try running the program in safe mode. I can also try waiting until Monday. Thanks.
  • 0

#4
Gammo

Gammo

    Trusted Helper

  • Malware Removal
  • 2,299 posts
Hi,

Forget about ComboFix. We'll try something else.

Run OTL again
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Check the box that says Scan All Users.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open a notepad window. OTL.Txt. This is saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it in your topic.





Please download aswMBR.exe to your desktop.
  • Double click the aswMBR.exe file to run it.

    Posted Image
  • When asked if you want to download Avast's virus definitions please select No.
  • Click the Scan button to start scan.

    Posted Image
  • On completion of the scan click Save log, save it to your desktop and post in your next reply.

  • 0

#5
vvnng

vvnng

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
OTL logfile created on: 8/26/2011 4:47:10 PM - Run 2
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\vng\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.97 Gb Total Physical Memory | 1.32 Gb Available Physical Memory | 67.22% Memory free
3.81 Gb Paging File | 3.33 Gb Available in Paging File | 87.32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.89 Gb Total Space | 202.17 Gb Free Space | 86.81% Space Free | Partition Type: NTFS

Computer Name: TEACHER011 | User Name: vng | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/08/24 11:13:20 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\vng\Desktop\OTL.exe
PRC - [2011/06/09 10:50:40 | 000,662,360 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\SecurityAgent\SecurityAgent.exe
PRC - [2011/06/09 10:50:38 | 000,182,616 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\SecurityAgent\SATray.exe
PRC - [2011/06/09 10:50:36 | 000,678,744 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\SecurityAgent\SAAlert.exe
PRC - [2011/05/11 15:46:54 | 000,568,168 | ---- | M] (DYMO) -- C:\Program Files\mimio\MimioStudio\mimiosys.exe
PRC - [2011/04/15 13:18:06 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe
PRC - [2011/03/15 14:06:08 | 000,232,104 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe
PRC - [2011/02/23 17:14:22 | 003,016,048 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\Aware.exe
PRC - [2011/02/04 17:48:30 | 001,767,792 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Response\DesktopMenu.exe
PRC - [2011/02/04 17:48:28 | 000,033,136 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Response\ResponseSoftwareService.exe
PRC - [2011/02/04 17:48:28 | 000,014,704 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Response\ResponseHardwareService.exe
PRC - [2011/01/25 18:10:42 | 000,846,704 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe
PRC - [2011/01/25 18:10:34 | 013,320,560 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardTools.exe
PRC - [2011/01/25 18:09:44 | 006,665,072 | ---- | M] (SMART Technologies ULC) -- C:\Program Files\SMART Technologies\SMART Product Drivers\Marker.exe
PRC - [2011/01/25 18:09:20 | 005,893,488 | ---- | M] (SMART Technologies) -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe
PRC - [2010/11/10 10:38:32 | 000,111,960 | ---- | M] (SRS Labs, Inc.) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe
PRC - [2010/09/17 21:14:22 | 000,460,144 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
PRC - [2010/08/27 17:39:22 | 002,178,208 | ---- | M] (Atheros Communications) -- C:\Program Files\Dell Wireless\Bluetooth Suite\BluetoothSuit.exe
PRC - [2010/06/04 15:29:14 | 000,292,208 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apoint.exe
PRC - [2010/05/31 17:57:12 | 000,056,032 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\hidfind.exe
PRC - [2010/05/31 14:17:06 | 000,054,640 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApntEx.exe
PRC - [2010/05/24 16:44:48 | 000,151,552 | ---- | M] (Atheros) -- C:\Program Files\Dell Wireless\Ath_CoexAgent.exe
PRC - [2010/04/15 11:26:44 | 000,447,632 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\IMAccDriver.exe
PRC - [2010/03/10 13:21:58 | 000,326,008 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\PowerAgent\PowerAgent.exe
PRC - [2010/03/10 13:21:58 | 000,171,896 | ---- | M] (Lightspeed Systems) -- C:\Program Files\Lightspeed Systems\PowerAgent\PowerAgentUser.exe
PRC - [2010/02/17 15:34:40 | 000,054,568 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2011/05/11 15:46:50 | 000,914,432 | ---- | M] () -- C:\Program Files\mimio\MimioStudio\system\gui_multimedia\js32.dll
MOD - [2011/02/04 17:49:46 | 000,463,728 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\ziparchive-vc100-3_1_1.dll
MOD - [2011/02/04 17:17:36 | 000,047,104 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\boost_thread-vc100-mt-1_44.dll
MOD - [2011/02/04 17:14:44 | 002,358,784 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\xqilla-vc100-1_0.dll
MOD - [2011/02/04 17:14:42 | 001,019,904 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\js32.dll
MOD - [2011/02/04 17:14:40 | 002,304,000 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\redland-vc100-1_0_9.dll
MOD - [2011/02/04 17:14:40 | 000,187,904 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Response\zlib-vc100-1_2_5.dll
MOD - [2011/01/25 18:15:40 | 000,571,248 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\ZipArchive.dll
MOD - [2010/11/01 12:58:18 | 007,540,224 | ---- | M] () -- C:\Program Files\Common Files\SMART Technologies\Qt 4.5.3 vs2010\QtGui4.dll
MOD - [2010/11/01 12:58:18 | 002,021,376 | ---- | M] () -- C:\Program Files\Common Files\SMART Technologies\Qt 4.5.3 vs2010\QtCore4.dll
MOD - [2010/10/12 10:48:34 | 000,877,056 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\QtNetwork4.dll
MOD - [2010/10/12 10:48:24 | 007,462,912 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\QtGui4.dll
MOD - [2010/10/12 10:48:22 | 002,011,648 | ---- | M] () -- C:\Program Files\SMART Technologies\SMART Product Drivers\QtCore4.dll
MOD - [2010/09/17 21:14:22 | 000,460,144 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
MOD - [2010/09/17 21:13:36 | 002,826,240 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\Core.dll
MOD - [2010/09/17 21:07:18 | 000,733,184 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\qca2.dll
MOD - [2010/08/27 17:39:20 | 000,012,448 | ---- | M] () -- C:\Program Files\Dell Wireless\Bluetooth Suite\athr_debug.dll
MOD - [2010/08/10 00:01:06 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2010/08/03 16:47:12 | 008,351,744 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtGui4.dll
MOD - [2010/08/03 16:47:12 | 002,244,608 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtCore4.dll
MOD - [2010/08/03 16:47:12 | 000,978,944 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtNetwork4.dll
MOD - [2010/08/03 16:47:12 | 000,364,544 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtXml4.dll
MOD - [2010/08/03 16:47:12 | 000,204,800 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\QtSql4.dll
MOD - [2010/04/15 11:26:44 | 000,447,632 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\IMAccDriver.exe
MOD - [2010/04/07 16:34:08 | 002,079,232 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\QtCore4.dll
MOD - [2010/04/07 16:34:06 | 007,738,368 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\QtGui4.dll
MOD - [2010/04/06 21:15:28 | 000,027,136 | ---- | M] () -- C:\Program Files\ELMO\Image Mate Accent\imageformats\qico4.dll
MOD - [2008/04/14 08:00:00 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2008/04/14 08:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/06/09 10:50:40 | 000,662,360 | ---- | M] (Lightspeed Systems) [Auto | Running] -- C:\Program Files\Lightspeed Systems\SecurityAgent\SecurityAgent.exe -- (IpmSecurityAgentService)
SRV - [2011/04/15 13:18:06 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) [Auto | Running] -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe -- (RosettaStoneDaemon)
SRV - [2011/02/04 17:48:28 | 000,014,704 | ---- | M] (SMART Technologies) [Auto | Running] -- C:\Program Files\SMART Technologies\SMART Response\ResponseHardwareService.exe -- (Response Hardware)
SRV - [2011/01/25 18:13:16 | 001,678,704 | ---- | M] (SMART Technologies ULC) [On_Demand | Stopped] -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe -- (SMART SNMP Agent Service)
SRV - [2011/01/25 18:10:42 | 000,846,704 | ---- | M] (SMART Technologies ULC) [Auto | Running] -- C:\Program Files\SMART Technologies\SMART Product Drivers\UCService.exe -- (SMART Display Controller)
SRV - [2011/01/25 18:09:20 | 005,893,488 | ---- | M] (SMART Technologies) [Auto | Running] -- C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe -- (SMART Board Service)
SRV - [2010/11/10 10:38:32 | 000,111,960 | ---- | M] (SRS Labs, Inc.) [Auto | Running] -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe -- (SRS_VolSync_Service)
SRV - [2010/09/17 21:14:22 | 000,460,144 | ---- | M] () [Auto | Running] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2010/05/24 16:44:48 | 000,151,552 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files\Dell Wireless\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent)
SRV - [2010/03/10 13:21:58 | 000,326,008 | ---- | M] (Lightspeed Systems) [Auto | Running] -- C:\Program Files\Lightspeed Systems\PowerAgent\PowerAgent.exe -- (PowerAgentService)


========== Driver Services (SafeList) ==========

DRV - [2011/06/09 10:31:06 | 000,177,760 | ---- | M] (Lightspeed Systems) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\SaFsFilter.sys -- (SAFsFilter)
DRV - [2011/06/09 10:29:12 | 000,040,032 | ---- | M] (Lightspeed Systems) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\IpmSecurityAgent1.sys -- (IpmSecurityAgent1)
DRV - [2010/09/27 09:53:52 | 000,384,800 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SRS_PremiumSound_i386.sys -- (SRS_PremiumSound_Service)
DRV - [2010/09/06 11:32:42 | 000,641,312 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathprot.sys -- (BTATHPROT)
DRV - [2010/09/06 11:32:42 | 000,071,968 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathusb.sys -- (BTATHUSB)
DRV - [2010/08/27 17:39:26 | 000,085,152 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathspp.sys -- (btathspp)
DRV - [2010/08/27 17:39:26 | 000,027,040 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathsco.sys -- (Atheros_btAudio)
DRV - [2010/08/27 17:39:26 | 000,012,832 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathrcp.sys -- (btathrcp)
DRV - [2010/08/27 17:39:24 | 000,072,864 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btatha2dp.sys -- (btatha2dp)
DRV - [2010/08/27 17:39:24 | 000,036,256 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btathpan.sys -- (btathPan)
DRV - [2010/08/25 14:22:26 | 001,938,048 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAU32.sys -- (CnxtHdAudService)
DRV - [2010/08/06 04:45:52 | 000,069,008 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\silabser.sys -- (silabser)
DRV - [2010/08/06 04:45:52 | 000,049,040 | ---- | M] (Silicon Laboratories, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\silabenm.sys -- (silabenm)
DRV - [2010/07/01 13:25:22 | 001,693,696 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2010/06/21 21:59:30 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/05/10 10:47:12 | 000,217,016 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2010/05/10 10:47:08 | 000,993,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2010/05/10 10:47:04 | 000,738,360 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2010/02/05 15:16:06 | 000,030,208 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LumensAV.sys -- (LumensCamera)
DRV - [2009/11/27 15:20:06 | 000,177,152 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2009/03/30 19:40:00 | 000,048,640 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\risdpe86.sys -- (risdpcie)
DRV - [2009/03/13 16:32:18 | 001,759,616 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2009/02/12 14:43:00 | 000,045,056 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimspe86.sys -- (rimspci)
DRV - [2008/11/16 19:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1659004503-1383384898-1343024091-4711\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1659004503-1383384898-1343024091-4711\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1659004503-1383384898-1343024091-4711\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 22 69 FD E6 D6 5E CC 01 [binary data]
IE - HKU\S-1-5-21-1659004503-1383384898-1343024091-4711\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.775: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.775: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.775: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\vng\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\vng\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\vng\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\vng\Local Settings\Application Data\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\AutocompletePro\[email protected]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\Firefox [2011/06/07 11:38:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/06/13 12:31:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/24 09:49:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/23 12:08:25 | 000,000,000 | ---D | M]

[2011/06/23 13:50:40 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\vng\Application Data\Mozilla\Extensions
[2011/05/11 13:11:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/06 15:52:07 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/03/02 15:10:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/05/11 11:52:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) --
[2010/09/15 18:25:04 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/01/24 12:34:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/08/24 09:49:17 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/04/14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2007/03/09 19:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/08/25 19:14:01 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (TODO: <Company name>)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [AtherosBtXpStack] C:\Program Files\Dell Wireless\Bluetooth Suite\BluetoothSuit.exe (Atheros Communications)
O4 - HKLM..\Run: [SecurityAgentTray] C:\Program Files\Lightspeed Systems\SecurityAgent\SATray.exe (Lightspeed Systems)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\Administrator.ICS1\Start Menu\Programs\Startup\Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Menu.lnk = C:\Program Files\SMART Technologies\SMART Response\DesktopMenu.exe (SMART Technologies)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\IMAccDriver.lnk = C:\Program Files\ELMO\Image Mate Accent\IMAccDriver.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MimioStudio.lnk = C:\Program Files\mimio\MimioStudio\mimiosys.exe (DYMO)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMART Board Tools.lnk = C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardTools.exe (SMART Technologies ULC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1659004503-1383384898-1343024091-4711\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1659004503-1383384898-1343024091-4711\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (TODO: <Company name>)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1284586548288 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ICS1.local
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\dell.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\dell.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/11 18:18:09 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/25 22:09:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Start Menu\Programs\LessonView
[2011/08/25 22:09:46 | 000,000,000 | ---D | C] -- C:\Program Files\LessonView
[2011/08/25 22:08:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Start Menu\Programs\TeacherEXPRESS
[2011/08/25 22:08:19 | 000,000,000 | ---D | C] -- C:\Program Files\TeacherEXPRESS
[2011/08/25 20:09:01 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011/08/25 19:24:46 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/08/25 19:22:25 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/08/25 19:22:25 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/08/25 19:22:25 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/08/25 19:22:25 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/08/25 19:22:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/08/25 19:22:06 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/08/25 19:21:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\vng\Start Menu\Programs\Administrative Tools
[2011/08/25 19:20:33 | 004,183,543 | R--- | C] (Swearware) -- C:\Documents and Settings\vng\Desktop\ComboFix.exe
[2011/08/25 19:13:51 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/08/24 11:13:19 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\vng\Desktop\OTL.exe
[2011/08/24 10:19:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\TweakNow RegCleaner
[2011/08/21 20:43:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Science PSSA
[2011/08/19 22:12:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations
[2011/08/19 22:06:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ExamView Pro Test Generator
[2011/08/19 22:06:42 | 000,000,000 | ---D | C] -- C:\ExamView
[2011/08/19 21:24:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Math Procedures Textbook
[2011/08/19 21:18:25 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\vng\IECompatCache
[2011/08/19 21:17:18 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\vng\PrivacIE
[2011/08/19 21:03:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\Malwarebytes
[2011/08/19 20:59:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Shortcuts
[2011/08/19 20:58:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Prentice Hall TeacherExpress
[2011/08/19 20:57:46 | 000,661,504 | ---- | C] (APEX Software Corporation) -- C:\WINDOWS\System32\tdbg5.ocx
[2011/08/19 20:57:46 | 000,484,128 | ---- | C] (Sheridan Software Systems, Inc.) -- C:\WINDOWS\System32\SSCALA32.OCX
[2011/08/19 20:57:46 | 000,291,848 | ---- | C] (ProtoView Development Corp.) -- C:\WINDOWS\System32\pvtreex.ocx
[2011/08/19 20:57:46 | 000,043,008 | ---- | C] (Prentice Hall) -- C:\WINDOWS\System32\QIWeekViewCell.ocx
[2011/08/19 20:57:45 | 000,526,856 | ---- | C] (FarPoint Technologies, Inc.) -- C:\WINDOWS\System32\Cal32x20.ocx
[2011/08/19 20:57:45 | 000,400,376 | ---- | C] (FarPoint Technologies, Inc.) -- C:\WINDOWS\System32\Flp32x20.ocx
[2011/08/19 20:57:45 | 000,393,216 | ---- | C] (ProtoView Development Corp.) -- C:\WINDOWS\System32\PVShared.dll
[2011/08/19 20:57:45 | 000,105,984 | ---- | C] (Seagate Software Information Management Group, Inc.) -- C:\WINDOWS\System32\P2BDAO.DLL
[2011/08/19 20:57:45 | 000,067,584 | ---- | C] (Quebecor Interactive) -- C:\WINDOWS\System32\PETree.ocx
[2011/08/19 20:57:45 | 000,056,832 | ---- | C] (Quebecor Interactive) -- C:\WINDOWS\System32\PETab.ocx
[2011/08/19 20:57:45 | 000,043,008 | ---- | C] (Intellia) -- C:\WINDOWS\System32\ICell.ocx
[2011/08/19 20:57:44 | 000,991,476 | ---- | C] (Seagate Software, Inc.) -- C:\WINDOWS\System32\CRYSTL32.OCX
[2011/08/19 20:57:43 | 003,572,224 | ---- | C] (Seagate Software Information Management Group, Inc.) -- C:\WINDOWS\System32\CRPE32.DLL
[2011/08/19 20:57:42 | 000,183,296 | ---- | C] (Seagate Software, Information Management Group, Inc.) -- C:\WINDOWS\System32\crpaig32.dll
[2011/08/19 20:57:42 | 000,056,320 | ---- | C] (Intellia) -- C:\WINDOWS\System32\ITab.ocx
[2011/08/19 20:57:41 | 000,067,072 | ---- | C] (Intellia) -- C:\WINDOWS\System32\ITree.ocx
[2011/08/19 20:57:40 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\IMPLODE.DLL
[2011/08/19 20:57:38 | 000,000,000 | ---D | C] -- C:\Program Files\Prentice Hall
[2011/08/19 20:57:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\WINDOWS
[2011/08/19 20:57:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\Inspiration Software
[2011/08/19 20:16:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Application Data\vlc
[2011/08/18 10:16:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\FlipShare Data
[2011/08/17 20:24:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\ICS 2010-11
[2011/08/17 20:24:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\Resume
[2011/08/17 20:24:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Desktop\25 Quick Formative Assessments for a Differentiated Classroom
[2011/08/15 14:57:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\vng\Local Settings\Application Data\Identities
[2010/09/11 19:27:52 | 000,196,608 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010/09/11 19:27:50 | 000,225,280 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll

========== Files - Modified Within 30 Days ==========

[2011/08/26 16:50:02 | 000,001,020 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-500UA.job
[2011/08/26 16:30:01 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-4711UA.job
[2011/08/26 16:30:01 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cc592ebc3e23a.job
[2011/08/26 16:30:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-4711Core.job
[2011/08/26 16:30:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc592eb1838ea.job
[2011/08/26 16:05:00 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1598462591-3747913773-3001106356-500UA.job
[2011/08/26 16:02:31 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/08/26 16:02:17 | 000,001,017 | ---- | M] () -- C:\Documents and Settings\vng\bmarchive.bms
[2011/08/26 16:01:48 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/08/26 16:01:33 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1659004503-1383384898-1343024091-500.job
[2011/08/26 16:01:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/25 19:24:51 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/08/25 19:20:45 | 004,183,543 | R--- | M] (Swearware) -- C:\Documents and Settings\vng\Desktop\ComboFix.exe
[2011/08/25 19:14:01 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/08/25 11:50:15 | 000,000,968 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-1383384898-1343024091-500Core.job
[2011/08/24 11:20:55 | 000,963,224 | ---- | M] () -- C:\WINDOWS\System32\drivers\FileIntegrity
[2011/08/24 11:13:20 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\vng\Desktop\OTL.exe
[2011/08/24 11:05:00 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1598462591-3747913773-3001106356-500Core.job
[2011/08/23 17:31:22 | 000,501,510 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/08/23 17:31:22 | 000,087,354 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/08/23 17:29:57 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/08/20 19:00:44 | 000,341,032 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/08/19 22:15:31 | 001,325,383 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\Science Energizers.pdf
[2011/08/19 22:10:33 | 000,002,104 | ---- | M] () -- C:\Documents and Settings\vng\Application Data\evpro32.prf
[2011/08/19 21:15:49 | 000,938,334 | ---- | M] () -- C:\WINDOWS\System32\drivers\FileIntegrity.bak1
[2011/08/17 17:44:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/15 15:51:35 | 000,077,139 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\CommitLetter-1.pdf
[2011/08/15 15:51:19 | 000,280,348 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\AdminLetter.pdf
[2011/08/15 14:23:30 | 000,293,312 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\Geology_Really_Rocks_Teacher_guide.pdf
[2011/08/15 11:15:54 | 000,289,514 | ---- | M] () -- C:\Documents and Settings\vng\Desktop\Academic_Standards_for_Science_and_Technology_and_Engineering_Education_(Elementary).pdf
[2011/08/15 10:44:49 | 000,000,376 | ---- | M] () -- C:\WINDOWS\ODBC.INI

========== Files Created - No Company Name ==========

[2011/08/25 19:24:51 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/08/25 19:24:49 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/08/25 19:22:25 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/08/25 19:22:25 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/08/25 19:22:25 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/08/25 19:22:25 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/08/25 19:22:25 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/08/19 22:15:37 | 001,325,383 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\Science Energizers.pdf
[2011/08/19 22:10:33 | 000,002,104 | ---- | C] () -- C:\Documents and Settings\vng\Application Data\evpro32.prf
[2011/08/19 20:57:52 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
[2011/08/19 20:57:52 | 000,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
[2011/08/15 15:51:36 | 000,077,139 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\CommitLetter-1.pdf
[2011/08/15 15:51:21 | 000,280,348 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\AdminLetter.pdf
[2011/08/15 14:23:34 | 000,293,312 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\Geology_Really_Rocks_Teacher_guide.pdf
[2011/08/15 11:15:54 | 000,289,514 | ---- | C] () -- C:\Documents and Settings\vng\Desktop\Academic_Standards_for_Science_and_Technology_and_Engineering_Education_(Elementary).pdf
[2011/08/12 16:25:58 | 000,000,886 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cc592ebc3e23a.job
[2011/08/12 16:25:57 | 000,000,882 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc592eb1838ea.job
[2011/06/13 18:13:39 | 000,246,804 | ---- | C] () -- C:\WINDOWS\System32\AtherosBT.bin
[2011/06/13 16:32:46 | 000,384,800 | R--- | C] () -- C:\WINDOWS\System32\drivers\SRS_PremiumSound_i386.sys
[2011/06/07 11:43:13 | 000,181,360 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/05/11 15:47:22 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\mimio_printer_resource.dll
[2011/05/04 15:30:50 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/03/18 10:50:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2011/01/25 12:26:17 | 024,514,448 | ---- | C] () -- C:\WINDOWS\System32\drivers\FileMD5.dat
[2010/09/18 09:05:30 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/09/16 09:05:23 | 000,000,053 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2010/09/16 09:05:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2010/09/15 23:05:18 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/15 20:49:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/09/15 19:23:38 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/09/15 18:32:00 | 068,341,708 | ---- | C] () -- C:\WINDOWS\System32\drivers\FileID.dat
[2010/09/15 18:32:00 | 068,341,670 | ---- | C] () -- C:\WINDOWS\System32\drivers\FileID.dat.bak
[2010/09/15 18:30:34 | 000,000,410 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010/09/11 19:27:52 | 001,759,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2010/09/11 19:27:52 | 000,028,544 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010/09/11 19:27:52 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2010/09/11 19:24:36 | 000,982,192 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2010/09/11 19:24:35 | 000,417,344 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2010/09/11 19:21:29 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010/09/11 18:19:58 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/09/11 18:15:19 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/09/11 14:07:49 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/09/11 14:06:50 | 000,341,032 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/29 17:22:30 | 000,246,804 | ---- | C] () -- C:\WINDOWS\System32\drivers\AtherosBt.bin
[2008/04/14 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 08:00:00 | 000,501,510 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/14 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 08:00:00 | 000,087,354 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/14 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/03/13 23:53:22 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\JPeg32.dll
[2007/03/15 11:47:48 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\BuEResNT.dll
[2005/04/15 12:52:33 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/04/15 12:52:33 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2011/06/14 11:29:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\completebartb
[2011/06/16 14:53:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Inspiration Software
[2011/06/13 15:43:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\mimio
[2011/06/13 15:43:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SMART Technologies
[2011/01/22 14:24:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\.smarttech-webinterface
[2011/04/25 14:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\Auslogics
[2011/06/07 11:40:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\completebartb
[2011/05/13 13:49:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\Free Video To Mp3 Wma Converter
[2010/09/16 09:30:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\Inspiration Software
[2011/05/11 15:47:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\mimio
[2011/06/07 11:40:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\PowerMp3WmaConverter
[2011/01/22 14:13:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\SMART Technologies
[2011/05/11 13:18:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\SMART Technologies Inc
[2010/09/15 18:33:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\TweakNow RegCleaner
[2011/06/07 11:40:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor
[2010/09/16 09:19:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund
[2011/01/22 14:22:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2011/06/16 14:59:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Flip Video
[2010/09/15 23:27:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ReadNaturally
[2011/06/16 14:40:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RosettaStoneLtdServices
[2011/01/22 14:11:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SMART Technologies
[2010/09/15 20:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/05/12 11:36:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\teacher\Application Data\mimio
[2011/05/12 11:42:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\teacher\Application Data\SMART Technologies
[2011/05/12 11:43:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\teacher\Application Data\SMART Technologies Inc
[2011/08/19 20:57:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\Inspiration Software
[2011/06/23 12:55:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\mimio
[2011/06/23 12:56:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\SMART Technologies
[2011/06/23 12:56:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\SMART Technologies Inc
[2011/08/24 10:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\vng\Application Data\TweakNow RegCleaner

========== Purity Check ==========



< End of report >
  • 0

#6
vvnng

vvnng

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-08-26 16:52:45
-----------------------------
16:52:45.437 OS Version: Windows 5.1.2600 Service Pack 3
16:52:45.437 Number of processors: 2 586 0x170A
16:52:45.437 ComputerName: TEACHER011 UserName: vng
16:52:46.093 Initialize success
16:52:50.250 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
16:52:50.250 Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
16:52:50.265 Disk 0 MBR read successfully
16:52:50.265 Disk 0 MBR scan
16:52:50.265 Disk 0 Windows XP default MBR code
16:52:50.265 Disk 0 scanning sectors +488397168
16:52:50.734 Disk 0 scanning C:\WINDOWS\system32\drivers
16:52:57.265 Service scanning
16:52:58.390 Modules scanning
16:53:04.015 Disk 0 trace - called modules:
16:53:04.031 ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys hal.dll
16:53:04.031 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a58aab8]
16:53:04.031 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8a605028]
16:53:04.031 Scan finished successfully
16:54:29.140 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\vng\Desktop\MBR.dat"
16:54:29.140 The log file has been saved successfully to "C:\Documents and Settings\vng\Desktop\aswMBR.txt"
  • 0

#7
Gammo

Gammo

    Trusted Helper

  • Malware Removal
  • 2,299 posts
Hi,

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\AutocompletePro\[email protected]
    [2011/06/14 11:29:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\completebartb
    [2011/06/07 11:40:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.ICS1\Application Data\completebartb
    
    :Services
    
    :Reg
    
    :Files
    ipconfig /flushdns /c
    C:\Program Files\AutocompletePro
    
    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [emptyflash]
    [createrestorepoint]
    [reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done





Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, click the "Update" tab and click the "Check For updates" button.
  • Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.





ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: Posted Image

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: Posted Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Posted Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically. The scan may take several hours.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Posted Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
  • 0

#8
vvnng

vvnng

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6797

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/27/2011 11:14:01 AM
mbam-log-2011-08-27 (11-14-01).txt

Scan type: Quick scan
Objects scanned: 202609
Time elapsed: 5 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • 0

#9
vvnng

vvnng

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
[email protected] as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=fde2647b332d5c41a90ef34a83062f99
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-08-27 11:43:46
# local_time=2011-08-27 07:43:46 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=95801
# found=0
# cleaned=0
# scan_time=4754
  • 0

#10
Gammo

Gammo

    Trusted Helper

  • Malware Removal
  • 2,299 posts
Hi,

That looks a lot better. I'd like you to re-do the Malwarebytes' Anti-Malware scan, since the database version you used yesterday is quite outdated. Shouldn't take more than 5 minutes.

Run Malwarebytes' Anti-Malware
  • Once the program has loaded, click the "Update" tab and click the "Check For updates" button.
  • Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
  • 0

#11
vvnng

vvnng

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
Yes, everything appears better as well. For whatever reason, Malwarebytes insisted that my version was the most updated. I re-downloaded the program and updated it to 8/28/11.


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7594

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/28/2011 10:39:14 AM
mbam-log-2011-08-28 (10-39-14).txt

Scan type: Quick scan
Objects scanned: 219361
Time elapsed: 5 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • 0

#12
Gammo

Gammo

    Trusted Helper

  • Malware Removal
  • 2,299 posts
Hi,

Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. ^_^

Remove Combofix now that we're done with it.
  • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
    Posted Image
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep a backup of your important files
Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Make proper use of your anti-virus and firewall
You should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so.

Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep all your software updated
It is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.

It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Use a safer web browser
Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.

If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Some other security programs

It is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.
  • A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.
  • SpywareBlaster to help prevent spyware from installing in the first place.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Be careful
Having security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.

Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.

Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Slow computer?
If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!

Cheers,
Gammo :)
  • 0

#13
vvnng

vvnng

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
Thanks for your help!
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP