Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

need winfixer removal help, please!

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Unread postby amateur » November 30th, 2005, 1:23 pm

Hi Floete, :)

Sorry for the delay. The forums have been very busy after the holiday. Thanks for being patient. I am glad that now you have an active antivirus software on your computer. The log is looking fine :D, but you are still not in the clear yet. :( I would like to know if you are the only user on this computer or not. If there are other users, we need to see their logs as well. Also, I need to know which version of Norton you had.

Please download Registry Search by Bobbi Flekman here

Create a folder named C:\Reg for it and unzip into that folder.

--------------------------

Please go to Start -> Control Panel -> Add/remove programs and remove the following programs, if found.

Norton Antivirus
DyFuCA
DyFuCA Active Alerts
Powerscan

----------------------------------

Make sure that you can see hidden files

Click Start
" Open My Computer
" Select the Tools menu and click Folder Options
" Select the View Tab
" Under the Hidden files and folders heading select Show hidden files and folders
" Uncheck the Hide protected operating system files (recommended) option
" Click Yes to confirm
" Click OK

--------------------------
Please print these instructions so that you'll have access to them while you are in safe mode.
--------------------------
Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.
---------------------------

Double-click the icon for RegSearch.exe in the C:\reg folder to launch the program.
Enter contextplus to search for and click "OK".
After completion Notepad will be opened with all the found instances of the string.
The resulting file is saved in the same folder location as RegSearch.exe. I will need that file later on.

------------------------------

Run HijackThis and put a checkmark against the following entries. Close all other windows except HijackThis. Click "Fix checked".

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

Close HijackThis.

Navigate (Start>My Computer>Local Disc ) and delete the following folders and the file in bold, if found:

C:\Documents and Settings\kv\Local Settings\Application Data\Wildtangent============folder
C:\Program Files\Norton AntiVirus ===============folder
C:\Program Files\Common Files\Symantec Shared ============folder
C:\Program Files\DyFuCa ==========folder
C:\Program Files\Powerscan ============folder
C:\Program Files\DyFuCa Active Alerts ==========folder

C:\WINDOWS\system32\dllnstrm.dll ==========file
C:\WINDOWS\system32\oddskrnl.exe =========file

-------------------------
Next, click Start>>>Run
Type into the box: cleanmgr.exe
Let it scan your system for files to remove. Make sure these 3 are checked and then press "OK" to remove:
Temporary Files
Temporary Internet Files
Recycle Bin
Navigate to C:\Documents and Settings\kv\Local Settings\Temp folder and make sure that it's empty.
---------------------------

Still in Safe Mode, run Ewido again.

----------------------------------

Reboot in Normal Mode.

To run an online scan at Ahnlab click here. The tool “Free online Virus and Spyware Scanâ€
User avatar
amateur
MRU Master
MRU Master
 
Posts: 2545
Joined: September 25th, 2005, 1:13 pm
Location: RI, USA
Advertisement
Register to Remove

Unread postby floete » December 1st, 2005, 8:47 pm

well, let's see now ... the norton version was, i think, norton antivirus 2004. it came with my laptop and i never used it.
all those checks you wanted me to put in the hijackthis results? after removing norton, all of em were also gone.
when i did cleanmgr, afterwards NO files had been removed from temp files and temp internet files. odd, since the results said they'd been emptied. anyway, i went and deleted all the files myself.
The Ahnlab scan just froze the computer, forcing me to reboot. wasn't able to get it to fx anything. there was no option for a report. i did see, however, that it said "343 files detected."
all the while, i'm getting popups everywhere few minutes or so ... which continues even now ...
and now to the results! here ya go:

Logfile of HijackThis v1.99.1
Scan saved at 7:09:26 PM, on 12/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ClipMate6\ClipMate.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\Program Files\ePrompter\ePrompter.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\kv\Desktop\hijack results\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [ISLP2STA.EXE] ISLP2STA.EXE START
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ClipMate6] C:\Program Files\ClipMate6\ClipMate.exe
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-its:mhtml:file://c:\nosunel.mht!http://daemonlinks.net/script/lc.chm::/bridge-c46.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://ahnlabdownload.nefficient.co.kr/ ... wall20.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Unknown owner - C:\WINDOWS\System32\DVDRAMSV.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)
O23 - Service: Swupdtmr - Unknown owner - c:\toshiba\ivp\swupdate\swupdtmr.exe (file missing)

--------------------

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:12:14 AM, 12/1/2005
+ Report-Checksum: 2E7293E9

+ Scan result:

No infected objects found.


::Report End

------------------------------

REGEDIT4

; Registry Search by Bobbi Flekman
; Version: 1.0.2.1

; Results at 12/1/2005 6:50:28 AM for strings:
; 'contextplus'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm]
"ServerAddress"="adchannel.contextplus.net"

[HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm]
"LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm\AU2]
"SU"="http://au.contextplus.net/services/AUServer"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01A47E8F-9F5C-47DE-A69B-F03A49D4768A}]
"DisplayName"="ContextPlus"

[HKEY_USERS\S-1-5-21-2159004305-1186145291-2834281119-1006\Software\C1iesAC9ZXtm\Cookies\Data\net\contextplus]

[HKEY_USERS\S-1-5-21-2159004305-1186145291-2834281119-1006\Software\C1iesAC9ZXtm\Cookies\Data\net\contextplus\adchannel.contextplus.net/services]

[HKEY_USERS\S-1-5-21-2159004305-1186145291-2834281119-1006\Software\C1iesAC9ZXtm\Cookies\Data\net\contextplus\adchannel.contextplus.net/services]
"freq_caps4"="MSCF;freq_caps4;zvmKQ1rwikPO+.....;adchannel.contextplus.net;/services;0;{NULL};"

; End Of The Log...


last two in a new message ....

Edited by Kim:
I did shorten the freq_caps4 line a little bit
;)
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

last two results

Unread postby floete » December 1st, 2005, 8:49 pm

here you go!

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 1 Current Build Number: 2600
Internet Explorer Version: 6.0.2800.1106

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
PECompact2 11/24/2005 1:15:22 PM 16569719 C:\WINDOWS\LPT$VPN.969
qoologic 11/24/2005 1:15:22 PM 16569719 C:\WINDOWS\LPT$VPN.969
SAHAgent 11/24/2005 1:15:22 PM 16569719 C:\WINDOWS\LPT$VPN.969
UPX! 5/3/2005 11:44:44 AM 25157 C:\WINDOWS\RMAgentOutput.dll
UPX! 1/10/2005 4:17:24 PM 170053 C:\WINDOWS\tsc.exe
PECompact2 11/24/2005 1:15:22 PM 16569719 C:\WINDOWS\VPTNFILE.969
qoologic 11/24/2005 1:15:22 PM 16569719 C:\WINDOWS\VPTNFILE.969
SAHAgent 11/24/2005 1:15:22 PM 16569719 C:\WINDOWS\VPTNFILE.969
UPX! 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll
aspack 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll

Checking %System% folder...
PEC2 3/31/2003 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc
PECompact2 11/2/2005 10:49:02 AM 2368864 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 11/2/2005 10:49:02 AM 2368864 C:\WINDOWS\SYSTEM32\MRT.exe
Umonitor 3/31/2003 7:00:00 AM 631808 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 3/31/2003 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...
UPX! 11/26/2005 8:20:12 PM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
FSG! 11/26/2005 8:20:12 PM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
PEC2 11/26/2005 8:20:12 PM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
aspack 11/26/2005 8:20:12 PM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
12/1/2005 10:14:40 AM S 2048 C:\WINDOWS\bootstat.dat
12/1/2005 7:00:24 PM H 24 C:\WINDOWS\p1J7N
11/29/2005 2:52:16 PM H 54156 C:\WINDOWS\QTFont.qfn
11/13/2005 8:46:52 PM H 10820 C:\WINDOWS\Help\nocontnt.GID
12/1/2005 3:49:26 PM H 1024 C:\WINDOWS\system32\config\default.LOG
12/1/2005 10:14:54 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG
12/1/2005 2:15:00 PM H 1024 C:\WINDOWS\system32\config\SECURITY.LOG
12/1/2005 6:55:42 PM H 1024 C:\WINDOWS\system32\config\software.LOG
12/1/2005 6:55:14 PM H 1024 C:\WINDOWS\system32\config\system.LOG
11/18/2005 1:08:38 PM H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG
11/2/2005 9:33:20 AM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\b16d5cf5-a97e-4bd3-b884-447508a8fb86
11/2/2005 9:33:20 AM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
12/1/2005 10:14:44 AM H 6 C:\WINDOWS\Tasks\SA.DAT

Checking for CPL files...
Microsoft Corporation 3/31/2003 7:00:00 AM 66048 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 578560 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 129024 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 150016 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
TOSHIBA Corp. 10/31/2003 2:28:06 PM 520192 C:\WINDOWS\SYSTEM32\HWSETUP.CPL
Intel Corporation 4/7/2003 3:14:30 AM 94208 C:\WINDOWS\SYSTEM32\igfxcpl.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 292352 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 121856 C:\WINDOWS\SYSTEM32\intl.cpl
Intersil Americas Inc. 10/3/2002 5:42:00 PM 296021 C:\WINDOWS\SYSTEM32\islp2cfg.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 65536 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems, Inc. 8/26/2005 6:14:42 PM 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 559616 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 256000 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 109056 C:\WINDOWS\SYSTEM32\powercfg.cpl
RealNetworks, Inc. 11/20/2003 8:24:42 PM 24576 C:\WINDOWS\SYSTEM32\prefscpl.cpl
Apple Computer, Inc. 7/27/2003 1:05:54 PM 295936 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 268288 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 3/31/2003 7:00:00 AM 90112 C:\WINDOWS\SYSTEM32\timedate.cpl
9/5/2003 4:36:40 PM 495616 C:\WINDOWS\SYSTEM32\TOSCDSPD.cpl
TOSHIBA Corporation 11/19/2003 9:16:36 PM 1257472 C:\WINDOWS\SYSTEM32\TPwrSave.cpl
Microsoft Corporation 5/26/2005 3:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Intel Corporation 4/7/2003 3:14:30 AM 94208 C:\WINDOWS\SYSTEM32\ReinstallBackups\0013\DriverFiles\igfxcpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
10/12/2005 12:44:06 PM 793 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
11/20/2003 6:46:40 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
4/4/2004 8:49:56 AM 533 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\D-Link AirPlus Xtreme G Configuration Utility.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
11/20/2003 10:37:56 AM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini

Checking files in %USERPROFILE%\Startup folder...
11/20/2003 6:46:40 PM HS 84 C:\Documents and Settings\kv\Start Menu\Programs\Startup\desktop.ini
11/27/2005 4:37:10 PM 714 C:\Documents and Settings\kv\Start Menu\Programs\Startup\ePrompter.lnk

Checking files in %USERPROFILE%\Application Data folder...
11/20/2003 10:37:56 AM HS 62 C:\Documents and Settings\kv\Application Data\desktop.ini
3/6/2004 6:46:28 PM H 0 C:\Documents and Settings\kv\Application Data\dm.ini

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\AVG7 Shell Extension
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{8C504614-A455-4CBA-81B4-D279644B8A7D}
= tfaxext.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\a2ContMenu
{AB77609F-2178-4E6F-9C4B-44AC179D937A} = C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG7 Shell Extension
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
= C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
Google Toolbar Helper = c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar1.dll
{8E718888-423F-11D2-876E-00A0C9082467} = &Radio : C:\WINDOWS\System32\msdxm.ocx

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java Console :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}
ButtonText = Research :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
ButtonText = Real.com :

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}
Search Band = %SystemRoot%\System32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
Media Band = %SystemRoot%\System32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Favorites Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
History Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}
&Research = C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = :
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
000StTHK 000StTHK.exe
TFNF5 TFNF5.exe
TFncKy TFncKy.exe
TPSMain TPSMain.exe
ISLP2STA.EXE ISLP2STA.EXE START
Apoint C:\Program Files\Apoint2K\Apoint.exe
OpwareSE2 "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
OPSE reminder "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
AVG7_CC C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
Yahoo! Pager C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background
ClipMate6 C:\Program Files\ClipMate6\ClipMate.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk
backup C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\MICROS~2\OFFICE11\ONENOTEM.EXE /tsr
item Microsoft Office OneNote 2003 Quick Launch
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk
backup C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\MICROS~2\OFFICE11\ONENOTEM.EXE /tsr
item Microsoft Office OneNote 2003 Quick Launch

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk
backup C:\WINDOWS\pss\RAMASST.lnkCommon Startup
location Common Startup
command C:\WINDOWS\system32\RAMASST.exe
item RAMASST
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk
backup C:\WINDOWS\pss\RAMASST.lnkCommon Startup
location Common Startup
command C:\WINDOWS\system32\RAMASST.exe
item RAMASST

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AGRSMMSG
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item AGRSMMSG
hkey HKLM
command AGRSMMSG.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item AGRSMMSG
hkey HKLM
command AGRSMMSG.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Apoint
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item Apoint
hkey HKLM
command C:\Program Files\Apoint2K\Apoint.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item Apoint
hkey HKLM
command C:\Program Files\Apoint2K\Apoint.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\B'sCLiP
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item BSCLIP
hkey HKLM
command C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item BSCLIP
hkey HKLM
command C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ccApp
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item ccApp
hkey HKLM
command "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item ccApp
hkey HKLM
command "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ctfmon.exe
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item ctfmon
hkey HKCU
command C:\WINDOWS\System32\ctfmon.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item ctfmon
hkey HKCU
command C:\WINDOWS\System32\ctfmon.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ezShieldProtector for Px
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item ezSP_Px
hkey HKLM
command C:\WINDOWS\System32\ezSP_Px.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item ezSP_Px
hkey HKLM
command C:\WINDOWS\System32\ezSP_Px.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HotKeysCmds
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item hkcmd
hkey HKLM
command C:\WINDOWS\System32\hkcmd.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item hkcmd
hkey HKLM
command C:\WINDOWS\System32\hkcmd.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IgfxTray
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item igfxtray
hkey HKLM
command C:\WINDOWS\System32\igfxtray.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item igfxtray
hkey HKLM
command C:\WINDOWS\System32\igfxtray.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LtMoh
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item Ltmoh
hkey HKLM
command C:\Program Files\ltmoh\Ltmoh.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item Ltmoh
hkey HKLM
command C:\Program Files\ltmoh\Ltmoh.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item msmsgs
hkey HKCU
command "C:\Program Files\Messenger\msmsgs.exe" /background
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item msmsgs
hkey HKCU
command "C:\Program Files\Messenger\msmsgs.exe" /background
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NAV CfgWiz
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item CfgWiz
hkey HKLM
command C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item CfgWiz
hkey HKLM
command C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NDSTray.exe
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item NDSTray
hkey HKLM
command NDSTray.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item NDSTray
hkey HKLM
command NDSTray.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PadTouch
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item PadExe
hkey HKLM
command "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item PadExe
hkey HKLM
command "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Pinger
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item pinger
hkey HKLM
command c:\toshiba\ivp\ism\pinger.exe /run
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item pinger
hkey HKLM
command c:\toshiba\ivp\ism\pinger.exe /run
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TFncKy
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TFncKy
hkey HKLM
command TFncKy.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TFncKy
hkey HKLM
command TFncKy.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TFNF5
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TFNF5
hkey HKLM
command TFNF5.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TFNF5
hkey HKLM
command TFNF5.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TOSCDSPD
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item toscdspd
hkey HKCU
command C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item toscdspd
hkey HKCU
command C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TouchED
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TouchED
hkey HKLM
command C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TouchED
hkey HKLM
command C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TPSMain
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TPSMain
hkey HKLM
command TPSMain.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item TPSMain
hkey HKLM
command TPSMain.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
system.ini 0
win.ini 0
bootini 0
services 0
startup 2


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui
= igfxsrvc.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 12/1/2005 7:00:56 PM



"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\System32\ctfmon.exe" [MS]
"Yahoo! Pager" = "C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet" [file not found]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"ClipMate6" = "C:\Program Files\ClipMate6\ClipMate.exe" ["Thornsoft Development, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"000StTHK" = "000StTHK.exe" [file not found]
"TFNF5" = "TFNF5.exe" [file not found]
"TFncKy" = "TFncKy.exe" [file not found]
"TPSMain" = "TPSMain.exe" [file not found]
"ISLP2STA.EXE" = "ISLP2STA.EXE START" [file not found]
"Apoint" = "C:\Program Files\Apoint2K\Apoint.exe" ["Alps Electric Co., Ltd."]
"OpwareSE2" = ""C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"" ["ScanSoft, Inc."]
"OPSE reminder" = ""C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"" ["ScanSoft, Inc."]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe" ["Sun Microsystems, Inc."]
"AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided)
\StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = "Google Toolbar Helper" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{C4213067-97B3-4929-9B98-B5600FBBBA13}" = "TouchED"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\TOSHIBA\TouchED\TouchED.dll" ["TOSHIBA Corporation"]
"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
a2ContMenu\(Default) = "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "kv" & "All Users" startup folders:
----------------------------------------------------

C:\Documents and Settings\kv\Start Menu\Programs\Startup
"ePrompter" -> shortcut to: "C:\Program Files\ePrompter\ePrompter.exe" ["Tiburon Technology, Inc."]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"D-Link AirPlus Xtreme G Configuration Utility" -> shortcut to: "C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe" ["D-Link"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = "&Google" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = "&Google" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]

Explorer Bars

HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Research" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.toshiba.com

Missing lines (compared with English-language version):
[Strings]: 1 line


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
ConfigFree Service, CFSvcs, "C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe" ["TOSHIBA CORPORATION"]
ewido security suite control, ewido security suite control, "C:\Program Files\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzlnt09\Driver = "hpzlnt09.dll" ["HP"]
Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 144 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 35 seconds.
---------- (total run time: 261 seconds)
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

Unread postby amateur » December 2nd, 2005, 11:31 am

Hi Floete, :)

Eventhough Apropos fix was negative, the latest scans prove that you are infected with a super hidden apropos which is one of the most difficult ones to detect and clean. :(

Please copy/paste the contents of the following box into a new Notepad document. Make sure that it's notepad, not wordpad. Otherwise the fix will not work.

@echo off
regedit /e %systemdrive%\rk1.txt "HKEY_CURRENT_USER\SOFTWARE\C1iesAC9ZXtm"
echo this was current user key >> %systemdrive%\rk1.txt
regedit /e %systemdrive%\rk2.txt "HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm"
echo this was local machine key >> %systemdrive%\rk2.txt
regedit /e %systemdrive%\rk3.txt "HKEY_LOCAL_MACHINE\Software\Aprps"
echo this was arps key >> %systemdrive%\rk3.txt
copy %systemdrive%\rk1.txt + %systemdrive%\rk2.txt + %systemdrive%\rk3.txt %systemdrive%\regkey.txt
del /q %systemdrive%\rk1.txt
del /q %systemdrive%\rk2.txt
del /q %systemdrive%\rk3.txt
exit

Save it to your Desktop as peek.bat. Save it as:
File Type: All Files (not as a text document or it won't work).
Name: peek.bat

Reboot your computer in Safe Mode. Please make sure that you log in to the computer under your account in Safe Mode, not the Admin Account.

  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
Log in on your account.
Locate peek.bat on your Desktop and double-click it. It will create a file named c:\regkey.txt. Boot into Normal Mode and post the content of c:\regkey.txt.

That's it for this time. ;)
User avatar
amateur
MRU Master
MRU Master
 
Posts: 2545
Joined: September 25th, 2005, 1:13 pm
Location: RI, USA

Unread postby floete » December 2nd, 2005, 1:13 pm

well, i did it, but maybe you can see more in the results than i can; to wit:

this was current user key
this was local machine key
this was arps key



that's all there was. did i do something wrong?
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

Unread postby amateur » December 2nd, 2005, 5:10 pm

Hi Floete, :)

It doesn't sound right. :( Did you run it in Safe Mode? It's imperative that you run it in Safe Mode. You may need to print these instructions so that you'll have access to them when you are in Safe Mode.

Please copy/paste the contents of the following box into a new Notepad document. Make sure that it's notepad, not wordpad. Otherwise the fix will not work.

@echo off
cd c:\windows
regedit /e %systemdrive%\rk1.txt "HKEY_CURRENT_USER\SOFTWARE\C1iesAC9ZXtm"
regedit /e %systemdrive%\rk2.txt "HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm"
regedit /e %systemdrive%\rk3.txt "HKEY_LOCAL_MACHINE\Software\Aprps"
exit

Save it to your Desktop as peek.bat. Save it as:
File Type: All Files (not as a text document or it won't work).
Name: peek.bat

Overwrite the existing peek.bat

Reboot your computer in Safe Mode. This is very important. You must be in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
Locate peek.bat on your Desktop and double-click it. Boot into Normal Mode and post the content of C:\rk1.txt, C:\rk2.txt and C:\rk3.txt.

If you still have the same result, please download and run RootkitRevealer 1.56 . Click on RootkitRevealer 1.56 under October 26. The (free) tool download is at the end of the page that opens. Once the RootkitRevealer is done, click file > save, and save the report

Post back the results of both.
User avatar
amateur
MRU Master
MRU Master
 
Posts: 2545
Joined: September 25th, 2005, 1:13 pm
Location: RI, USA

Unread postby floete » December 3rd, 2005, 8:51 am

well, i got the same exact results from peek.bat as i did before. on the other hand, i got back over 1000 entries for the rootkitreveal scan. for your edification and mounting insanity, here they are. again, thanks for the help on this thorny matter!

HKLM\SOFTWARE\C1iesAC9ZXtm 12/2/2005 11:03 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDRMGMT 11/25/2005 12:55 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\Cdrmgmt 12/2/2005 11:08 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu 12/2/2005 5:50 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\ace.dll 11/25/2005 12:56 PM 568.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\AI_01-12-2005.log 12/1/2005 6:09 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_02-12-2005.log 12/2/2005 5:50 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_26-11-2005.log 11/26/2005 6:25 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_27-11-2005.log 11/27/2005 12:00 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_28-11-2005.log 11/28/2005 12:00 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_29-11-2005.log 11/29/2005 6:29 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_30-11-2005.log 11/30/2005 7:24 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache 12/2/2005 11:12 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4388a551_000e1113 12/2/2005 11:10 PM 34.62 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4388afc8_000c65d4 11/26/2005 1:56 PM 52.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43890ce9_0004c4b4 11/26/2005 8:33 PM 43.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43899f86_000ec82e 11/27/2005 6:59 AM 65.25 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4389f1b3_00016e36 11/27/2005 12:49 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_438a5a68_00057bcf 11/27/2005 8:16 PM 60.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_438f060e_0003c1ae 12/1/2005 9:17 AM 112.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_438f179c_000e8b25 12/1/2005 10:32 AM 483 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_439027d3_0007de29 12/2/2005 5:54 AM 38.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43908066_0006ea05 12/2/2005 12:12 PM 313.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4390c1de_000487ab 12/2/2005 4:51 PM 3.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43911ad2_000bebc2 12/2/2005 11:10 PM 340.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_4388a73f_00029f63 11/26/2005 1:19 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_4388f2cd_0007270e 11/26/2005 6:42 PM 19.19 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_438af6d3_00089544 11/28/2005 7:23 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_438fb698_000d59f8 12/1/2005 9:51 PM 4.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_4388a6aa_000487ab 11/27/2005 4:39 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_4388da3a_00003d09 11/26/2005 4:57 PM 42.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_4389a1f1_0007a120 11/27/2005 7:09 AM 71.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_438a2776_00081b32 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_438a5aba_000c28cb 11/27/2005 8:17 PM 4.96 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_438f1836_00007a12 12/2/2005 10:06 AM 2.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_43902958_0004c4b4 12/2/2005 6:00 AM 44.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_43905d6c_00039387 12/2/2005 9:43 AM 4.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_43911263_000d1cef 12/2/2005 10:34 PM 59.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000000c1_438fbcdd_000a7d8c 12/1/2005 10:17 PM 9.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4388a6be_00007a12 11/26/2005 1:17 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4388dc32_000ca2dd 11/26/2005 5:05 PM 408 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_43892b03_000baeb9 12/1/2005 10:01 PM 15.64 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4389a47d_00066ff3 11/27/2005 7:20 AM 14.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_438a27a3_0004c4b4 11/27/2005 4:39 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_438a67df_000501bd 11/27/2005 9:15 PM 37.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_438f56f4_000af79e 12/1/2005 3:06 PM 2.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_43902dff_00053ec6 12/2/2005 6:20 AM 33.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4390630c_0007de29 12/2/2005 10:06 AM 316 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_43911556_000c28cb 12/2/2005 10:47 PM 26.60 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_4388a6aa_0009c671 11/26/2005 1:17 PM 303 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_4388da47_0002dc6c 11/26/2005 4:57 PM 27.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438922bd_00022551 11/26/2005 10:06 PM 4.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_4389a219_00016e36 11/27/2005 7:10 AM 97.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438a2777_0008583b 11/27/2005 4:39 PM 302 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438a6377_0001312d 11/27/2005 8:55 PM 59.10 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438f1836_0007de29 12/1/2005 10:35 AM 3.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_43902964_00090f56 12/2/2005 6:00 AM 44.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_43905d74_000d1cef 12/2/2005 9:43 AM 19.73 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_43911280_000bebc2 12/2/2005 10:43 PM 77.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_4388a747_000bebc2 11/26/2005 1:19 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_4388f574_00029f63 11/26/2005 6:53 PM 9.86 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_438af700_0001312d 11/28/2005 7:24 AM 35.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_438fb6b4_00090f56 12/2/2005 6:05 AM 137.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001e1_438fc5e9_000a037a 12/1/2005 10:56 PM 11.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_4388a6a7_0008d24d 11/27/2005 4:38 PM 468 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_4388b117_000dd40a 12/2/2005 10:30 PM 41.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_43890dce_0001312d 11/26/2005 10:39 PM 78.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_4389a181_000baeb9 11/27/2005 7:07 AM 12.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_438a5aaf_000632ea 11/27/2005 8:17 PM 15.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_438f182c_0000f424 12/1/2005 10:35 AM 586 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_43902894_0003d090 12/2/2005 5:57 AM 6.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_43905d01_00066ff3 12/2/2005 9:41 AM 28.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_439111b9_00098968 12/2/2005 10:34 PM 6.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4388a6bb_000ca2dd 11/26/2005 1:17 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4388dc2b_000e4e1c 11/26/2005 5:05 PM 1.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_43892ab7_000d1cef 11/26/2005 10:40 PM 60.50 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4389a3fc_00031975 11/27/2005 7:18 AM 1.58 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_438a279f_00007a12 11/27/2005 4:39 PM 413 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_438a6791_0001ab3f 11/27/2005 9:12 PM 85.69 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_438f5688_0008583b 12/1/2005 3:01 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_43902db4_000d59f8 12/2/2005 6:19 AM 37.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_43906077_0006acfc 12/2/2005 9:55 AM 41.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4391151d_000d59f8 12/2/2005 10:46 PM 4 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_4388a71a_0003d090 11/26/2005 1:19 PM 510 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_438af2d0_000a037a 11/28/2005 7:06 AM 10.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_438f609a_000501bd 12/1/2005 3:44 PM 1.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_43907c2e_00057bcf 12/2/2005 11:54 AM 21.36 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000390_438fbdbf_0001ab3f 12/1/2005 10:21 PM 29.42 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_4388a6fd_0008d24d 11/26/2005 1:18 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_4388eaf7_000cdfe6 11/26/2005 6:08 PM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_43899ee6_0007de29 11/27/2005 6:57 AM 2.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_4389b908_0005f5e1 11/27/2005 8:47 AM 173.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_438a7366_000a4083 11/27/2005 10:03 PM 160.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_438f5bfb_0008d24d 12/1/2005 3:24 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_43906704_0005b8d8 12/2/2005 10:23 AM 109.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000588_438fbaad_000aba95 12/1/2005 10:08 PM 13.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000633_4388af40_0002625a 11/27/2005 8:53 PM 937 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000633_438af9d5_000a037a 11/28/2005 7:36 AM 2.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000633_438fb892_0002625a 12/1/2005 9:59 PM 62.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_4388a724_00089544 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_4388f12b_00040d99 11/26/2005 6:35 PM 254 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_438af56c_000e4e1c 11/28/2005 7:17 AM 89.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_438f609c_0006acfc 12/1/2005 3:44 PM 378 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_43907c36_0007de29 12/2/2005 11:54 AM 17.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000728_438fc58f_00031975 12/1/2005 10:54 PM 1.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4388a6bd_000af79e 11/26/2005 1:17 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4388dc32_000baeb9 11/26/2005 5:05 PM 407 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_43892b02_000632ea 11/26/2005 10:41 PM 126.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4389a419_000487ab 11/27/2005 7:18 AM 23.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_438a27a2_000ec82e 11/27/2005 4:39 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_438a67db_000c65d4 11/27/2005 9:13 PM 36.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_438f56f2_000a7d8c 12/1/2005 3:02 PM 6.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_43902dfe_00098968 12/2/2005 6:20 AM 6.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4390607a_0008583b 12/2/2005 9:55 AM 4.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_43911554_000e4e1c 12/2/2005 10:47 PM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_4388a6b0_000a037a 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_4388daa2_0006acfc 11/26/2005 4:58 PM 8.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438928ed_000af79e 11/26/2005 10:33 PM 254 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_4389a2f7_000b71b0 11/27/2005 7:13 AM 288.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438a2786_000a4083 11/27/2005 4:39 PM 724 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438a6518_000a4083 11/27/2005 9:02 PM 4.19 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438f55c2_0008583b 12/1/2005 2:57 PM 239 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_43902c39_000f0537 12/2/2005 6:12 AM 11.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_43905e2e_0007a120 12/2/2005 9:46 AM 52.34 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_43911340_000aba95 12/2/2005 10:38 PM 77.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_4388a73f_00076417 11/26/2005 1:19 PM 711 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_4388f2d5_000b34a7 11/26/2005 6:42 PM 117.67 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_438af6d3_000a037a 11/28/2005 7:23 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_438fb6a3_000b71b0 12/2/2005 9:45 AM 52.82 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4388a6d0_000b34a7 11/26/2005 1:17 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4388dcc8_0005f5e1 11/26/2005 5:08 PM 402 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4389b2cf_00098968 12/1/2005 9:50 PM 21.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_438a70b2_000dd40a 11/27/2005 9:51 PM 8.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_438f5928_000af79e 12/1/2005 3:12 PM 711 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4390303b_0002625a 12/2/2005 6:30 AM 88.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_43906589_000ca2dd 12/2/2005 10:17 AM 53.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000086a_438fbc6c_00040d99 12/1/2005 10:15 PM 9.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000871_438fc61b_00076417 12/1/2005 10:57 PM 48.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000878_438fc727_0008583b 12/1/2005 11:01 PM 48.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_4388a6dd_000e4e1c 11/26/2005 1:18 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_4388ddbc_00053ec6 11/26/2005 5:12 PM 466 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_43892e8d_000bebc2 11/27/2005 7:02 AM 13.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_4389b329_0007a120 11/27/2005 8:22 AM 1.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_438a7179_00016e36 11/27/2005 9:54 PM 4.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_438f596f_000af79e 12/1/2005 3:13 PM 248 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_439065eb_0001ab3f 12/2/2005 10:19 AM 43.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000940_438fbc7d_00076417 12/1/2005 10:16 PM 4.55 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_4388a759_000e1113 12/2/2005 11:10 PM 214.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_438908e9_00031975 11/26/2005 8:16 PM 5.29 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_438af751_0008d24d 11/28/2005 7:25 AM 39.89 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_438fb6f0_000b34a7 12/1/2005 9:52 PM 3.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000009ce_438fbaf6_00090f56 12/1/2005 10:09 PM 3.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000a28_438fbaf6_0007270e 12/1/2005 10:09 PM 1.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000a4a_438fba4a_000501bd 12/1/2005 10:06 PM 8.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_4388a6a7_0009c671 11/26/2005 1:17 PM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_4388b11d_000a4083 11/26/2005 2:01 PM 51.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_4389a19b_000d1cef 11/27/2005 7:07 AM 30.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_438a276f_000af79e 11/27/2005 4:38 PM 361.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_438a5ab0_00089544 11/27/2005 8:17 PM 11.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_438f1834_0002625a 12/1/2005 10:35 AM 316 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_43902898_0008d24d 12/2/2005 5:57 AM 3.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_43905d07_0000b71b 12/2/2005 9:41 AM 143.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_439111d2_000e4e1c 12/2/2005 10:32 PM 98.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_4388a6bc_000a4083 11/27/2005 4:39 PM 4.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_4388dc32_0003d090 11/26/2005 5:05 PM 36.07 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_43892ae0_00031975 11/26/2005 10:41 PM 40.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_438a279f_00094c5f 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_438a67b8_000ca2dd 11/27/2005 9:13 PM 32.57 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_438f56b0_000f0537 12/1/2005 3:01 PM 600 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_43902dfd_00000000 12/2/2005 6:20 AM 33.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_43906078_000b71b0 12/2/2005 9:55 AM 417 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_4391153a_00090f56 12/2/2005 10:47 PM 5.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c15_4388af3f_0009c671 11/27/2005 8:53 PM 937 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c15_438af988_000d9701 11/28/2005 7:35 AM 20.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c15_438fb82a_00040d99 12/1/2005 9:57 PM 60.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c7b_4388af3e_00053ec6 11/26/2005 1:53 PM 937 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c7b_438af8c6_0002625a 11/28/2005 7:46 AM 71.75 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c7b_438fb7eb_000b34a7 12/1/2005 9:56 PM 56.19 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ce1_438fbcde_0008583b 12/1/2005 10:17 PM 4.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_4388a702_00076417 11/26/2005 1:18 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_4388eb1c_00044aa2 12/2/2005 4:52 PM 8.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_43899ee9_000bebc2 11/27/2005 6:57 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_438a73d4_0004c4b4 11/27/2005 10:04 PM 2.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_438f5c1a_0000f424 12/1/2005 3:24 PM 4.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_4390675d_0001312d 12/2/2005 10:25 AM 70.10 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d6a_438fbc9b_00029f63 12/1/2005 10:16 PM 49.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4388a6c4_0003d090 11/26/2005 1:17 PM 468 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4388dc50_000c65d4 11/26/2005 5:06 PM 1.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_43892b82_0004c4b4 11/26/2005 10:44 PM 4.50 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4389aca3_000e1113 11/27/2005 7:54 AM 352.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_438a700a_0003567e 11/27/2005 9:48 PM 117.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_438f57f7_0002dc6c 12/1/2005 3:07 PM 635 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_43902f54_0007a120 12/2/2005 6:26 AM 59.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_43906429_000d1cef 12/2/2005 10:11 AM 6.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4391166a_00053ec6 12/2/2005 10:52 PM 70.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000de5_438fbaec_0006ea05 12/1/2005 10:09 PM 15.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_4388a72b_00076417 11/26/2005 1:19 PM 510 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_438af649_00057bcf 11/28/2005 7:21 AM 85.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_438f899a_00094c5f 12/1/2005 6:39 PM 35.70 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_43907cb4_000a037a 12/2/2005 11:56 AM 46.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e29_438fc789_000c28cb 12/1/2005 11:03 PM 2.41 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_4388a748_0007a120 11/26/2005 1:19 PM 678 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_4388f58f_000501bd 11/26/2005 6:53 PM 22.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_438af70b_000e1113 11/28/2005 7:24 AM 35.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_438fb6e1_000d9701 12/2/2005 9:45 AM 53.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ea9_438fbcb3_000c28cb 12/1/2005 10:17 PM 4.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_4388a747_00040d99 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_4388f30d_0001312d 11/26/2005 6:43 PM 32.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_438af6d9_0000b71b 11/28/2005 7:23 AM 80.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_438fb6b3_000ca2dd 12/1/2005 9:51 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4388a6aa_0002625a 11/26/2005 1:17 PM 38.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4388da13_0001ab3f 11/26/2005 4:56 PM 20.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_43892240_00016e36 11/26/2005 10:04 PM 261.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4389a1ec_0001312d 11/27/2005 7:09 AM 26.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_438a2775_0008583b 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_438a5aba_0009c671 11/27/2005 8:17 PM 2.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_438f1835_000a4083 12/1/2005 10:35 AM 1.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4390294f_000c28cb 12/2/2005 6:00 AM 4 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_43905d67_000c65d4 12/2/2005 9:42 AM 104.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_43911248_0009c671 12/2/2005 10:34 PM 100.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_4388a6f6_0009c671 11/26/2005 1:18 PM 492 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_4388ea53_00016e36 11/26/2005 6:05 PM 39.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_43899eba_0005b8d8 11/27/2005 6:55 AM 802 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_4389b856_0009c671 11/27/2005 8:44 AM 149.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_438a734d_00016e36 11/27/2005 10:02 PM 2.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_438f5bb0_0001ab3f 12/1/2005 3:23 PM 618 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_439066d8_00003d09 12/2/2005 10:23 AM 64.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_4388a72b_0001e848 11/26/2005 1:19 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_4388f14a_0009c671 11/26/2005 6:35 PM 26.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_438af639_00057bcf 11/28/2005 7:21 AM 122.97 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_438f8990_0002dc6c 12/1/2005 6:38 PM 112.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_43907cae_000632ea 12/2/2005 11:56 AM 36.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001030_438fc5f1_0003d090 12/1/2005 10:56 PM 48.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001049_438fbc6b_000dd40a 12/1/2005 10:15 PM 48.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000010d9_438fbd7c_00000000 12/1/2005 10:20 PM 26.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000010d9_438fc5a3_000f0537 12/1/2005 10:55 PM 550 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000117a_438fc6fc_0001312d 12/1/2005 11:01 PM 48.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_4388a734_00016e36 11/26/2005 1:19 PM 4.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_4388f17e_000bebc2 11/26/2005 6:36 PM 5.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_438af69e_000e8b25 11/28/2005 7:22 AM 119.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_438f9718_000e8b25 12/1/2005 7:36 PM 391.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_4388a6d5_000b71b0 11/27/2005 4:39 PM 800 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_4388ddbb_0002dc6c 11/26/2005 5:12 PM 383 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_43892d80_0005b8d8 11/26/2005 10:52 PM 603 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_4389b310_000c28cb 11/27/2005 8:22 AM 2.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_438a70e8_0006ea05 11/27/2005 9:52 PM 4.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_438f5954_000e1113 12/1/2005 3:28 PM 519 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_439065cd_0001e848 12/2/2005 10:18 AM 32.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_4388a6b4_0003567e 11/26/2005 1:17 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_4388db5b_000bebc2 11/26/2005 5:02 PM 93.21 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438929be_000a4083 11/26/2005 10:36 PM 63.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_4389a3b8_0001e848 11/27/2005 7:16 AM 1.58 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438a2793_000b34a7 11/27/2005 4:39 PM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438a6620_0009c671 11/27/2005 9:06 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438f55ef_000f0537 12/1/2005 2:58 PM 237 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_43902c9d_0008d24d 12/2/2005 6:14 AM 64 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_439114da_00003d09 12/2/2005 10:48 PM 77.57 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_4388a73e_00076417 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_4388f2ca_0001ab3f 11/26/2005 6:42 PM 169.69 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_438af6d3_00039387 11/28/2005 7:23 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_438fb698_000a037a 12/1/2005 9:51 PM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4388a6a8_000501bd 11/26/2005 1:17 PM 724 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4388b139_000632ea 11/26/2005 2:02 PM 74.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438921ac_000aba95 11/26/2005 10:02 PM 150.16 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4389a1bc_000487ab 12/2/2005 9:50 AM 37.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438a2772_000e1113 11/27/2005 4:39 PM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438a5ab2_0005b8d8 11/27/2005 8:17 PM 32.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438f1834_0005b8d8 12/2/2005 10:06 AM 197 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4390292e_00089544 12/2/2005 5:59 AM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_43905d2c_00029f63 12/2/2005 9:41 AM 213.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_439111e2_00003d09 12/2/2005 10:32 PM 98.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_4388a6d4_0006ea05 11/26/2005 1:17 PM 413 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_4388dcc9_0002dc6c 11/26/2005 5:08 PM 1.65 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_43892d7c_0001ab3f 11/26/2005 10:52 PM 19.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_4389b301_00076417 11/27/2005 8:22 AM 136.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_438a70db_0001312d 11/27/2005 9:52 PM 5.28 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_438f592b_0007de29 12/1/2005 3:12 PM 653 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_439065ae_000b71b0 12/2/2005 10:18 AM 6.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001316_438afded_00016e36 11/28/2005 7:54 AM 260.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001316_438fba9f_0008583b 12/1/2005 10:08 PM 1.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_4388a6c8_000c28cb 11/26/2005 1:17 PM 73.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_4388dc66_0005f5e1 11/26/2005 5:06 PM 1.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43892c45_00016e36 11/26/2005 10:47 PM 24.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_4389adbf_0007de29 11/27/2005 7:59 AM 50.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_438a706d_00076417 12/2/2005 9:45 AM 428 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_438f587a_00022551 12/1/2005 3:12 PM 1.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43902f95_0005b8d8 12/2/2005 6:27 AM 21.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43906492_000dd40a 12/2/2005 10:13 AM 18.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43911749_00016e36 12/2/2005 10:55 PM 17.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000138a_438fbb93_000e4e1c 12/1/2005 10:12 PM 55.68 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_4388a6e0_000ec82e 11/26/2005 1:18 PM 1.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_4388debe_000501bd 11/26/2005 5:16 PM 427 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_43892ea4_0005b8d8 11/26/2005 10:57 PM 148 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_4389b3b4_000d9701 11/27/2005 8:25 AM 361.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_438a7205_0003567e 11/27/2005 9:57 PM 86.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_438f59b3_000e1113 12/1/2005 3:14 PM 6.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_43906606_000d59f8 12/2/2005 10:19 AM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013d3_438fbaf5_000ca2dd 12/1/2005 10:09 PM 3.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_4388a6eb_000c65d4 11/26/2005 1:18 PM 1.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_4388e26a_000aba95 11/27/2005 7:13 AM 100.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_43892fb4_000a4083 11/26/2005 11:02 PM 57.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_4389b49d_00029f63 11/27/2005 8:29 AM 53.86 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_438a7326_000b34a7 11/27/2005 10:01 PM 16.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_438f5a88_00022551 12/1/2005 3:18 PM 7.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_43906674_0009c671 12/2/2005 10:21 AM 70.25 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001481_4388a772_0003567e 11/27/2005 4:39 PM 1.07 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001481_438af7d0_000e8b25 11/28/2005 7:28 AM 40.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001481_438fb7a8_000ca2dd 12/1/2005 9:55 PM 1.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4388a6a8_0008d24d 11/26/2005 1:17 PM 634 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4388d9ed_000cdfe6 11/26/2005 4:55 PM 18.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438921c1_00044aa2 11/26/2005 10:02 PM 78.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4389a1ce_0007de29 11/27/2005 7:08 AM 30.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438a2773_000a037a 11/27/2005 4:39 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438a5ab6_000f0537 11/27/2005 8:17 PM 1.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438f1834_0007de29 12/1/2005 10:35 AM 993 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4390294e_000c65d4 12/2/2005 6:00 AM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_43905d32_000ca2dd 12/2/2005 9:41 AM 12.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4391120c_000d59f8 12/2/2005 10:33 PM 75.96 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_4388a6af_000e1113 11/26/2005 1:17 PM 17.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_4388da7c_000d1cef 11/26/2005 4:58 PM 7.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438928b3_000a7d8c 11/26/2005 10:32 PM 43.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_4389a29d_000cdfe6 11/27/2005 7:12 AM 38.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438a2780_0008d24d 11/27/2005 4:39 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438a64b5_0005b8d8 11/27/2005 9:00 PM 88.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438f55bb_0009c671 12/1/2005 2:57 PM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_43902c34_00003d09 12/2/2005 6:12 AM 426 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_43905e04_000dd40a 12/2/2005 9:45 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_439112ae_00076417 12/2/2005 10:36 PM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000159f_438fc622_0007a120 12/1/2005 10:58 PM 60.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4388a6cf_0007de29 11/26/2005 1:17 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4388dcb8_000cdfe6 11/26/2005 5:07 PM 462 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_43892d3a_0003d090 11/26/2005 10:52 PM 29.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4389af31_0003d090 11/27/2005 8:05 AM 3.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_438a708a_0006ea05 11/27/2005 9:50 PM 7.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_438f58d2_00039387 12/1/2005 3:10 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4390301a_00029f63 12/2/2005 6:29 AM 167.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4390650e_0007a120 12/2/2005 10:17 AM 31.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_43911809_00076417 12/2/2005 10:59 PM 380.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001643_438fbae9_00044aa2 12/1/2005 10:11 PM 62.10 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4388a6a4_000632ea 11/27/2005 4:38 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4388b0d9_0000b71b 11/26/2005 2:00 PM 473 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43890d80_000baeb9 11/26/2005 8:36 PM 81.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4389a12f_0005f5e1 11/27/2005 7:06 AM 84.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4389f37f_0007de29 11/27/2005 12:57 PM 28.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_438a5aa7_00007a12 11/27/2005 8:17 PM 786 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_438f0691_000a6eaa 12/1/2005 9:20 AM 97 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_438f17de_00094c5f 12/1/2005 10:33 AM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43902852_0006ea05 12/2/2005 5:56 AM 3.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43905cab_0005b8d8 12/2/2005 9:39 AM 8.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43911180_000d1cef 12/2/2005 10:31 PM 76.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000169a_438fbd57_00039387 12/1/2005 10:19 PM 37.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_4388a6e8_00053ec6 11/26/2005 1:18 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_4388e263_000aba95 12/2/2005 6:00 AM 282.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_43892f0d_0000f424 11/26/2005 10:59 PM 33.49 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_4389b3fd_00081b32 11/27/2005 4:40 PM 40.34 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_438a72c8_0002625a 11/27/2005 10:00 PM 87.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_438f5a44_0009c671 12/1/2005 3:17 PM 1.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_43906611_0002dc6c 12/2/2005 10:19 AM 15.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016d4_4388a7df_00016e36 12/2/2005 10:35 AM 7.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016d4_438af84f_00098968 11/28/2005 7:30 AM 67.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016d4_438fb7e3_00089544 12/1/2005 9:56 PM 3.45 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001796_438afb9f_0007de29 11/28/2005 7:44 AM 110.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001796_438fba0a_000d59f8 12/1/2005 10:05 PM 4.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000182f_438afc1d_0008d24d 11/28/2005 7:46 AM 67.73 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000182f_438fba2b_0008d24d 12/1/2005 10:06 PM 7.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001850_4388a7d5_000ec82e 11/26/2005 1:22 PM 20.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001850_438af7ec_0000f424 11/28/2005 7:28 AM 12.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001850_438fb7b6_0007270e 12/1/2005 9:55 PM 54.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4388a6e6_000e1113 11/26/2005 1:18 PM 1.16 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4388e25c_00098968 12/2/2005 6:00 AM 170.97 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_43892ee9_000d59f8 11/26/2005 10:58 PM 39.63 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4389b3f2_000d1cef 11/27/2005 4:39 PM 1.41 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_438a728b_00031975 11/27/2005 9:59 PM 18.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_438f5a42_000a4083 12/1/2005 3:17 PM 1.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4390660e_000a7d8c 12/2/2005 10:19 AM 47.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4388a611_000aba95 12/2/2005 6:22 AM 248.64 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4388afcc_000e4e1c 11/26/2005 1:56 PM 90.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_43890d4a_000e8b25 11/26/2005 8:35 PM 39.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_43899ffe_00044aa2 12/1/2005 7:50 PM 69.36 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4389f1cf_00098968 11/27/2005 12:50 PM 676 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_438a5a83_0001ab3f 11/27/2005 8:16 PM 1.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_438f17b2_000e4e1c 12/1/2005 10:55 PM 90.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_439027f4_00003d09 12/2/2005 5:54 AM 3.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_439080ab_0009c671 12/2/2005 12:13 PM 325.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4390c201_000baeb9 12/2/2005 4:59 PM 7.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_4388a725_000632ea 11/26/2005 1:19 PM 211 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_4388f12c_00031975 11/26/2005 6:35 PM 1.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_438af5cb_00040d99 11/28/2005 7:19 AM 81.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_438f60ba_000632ea 12/1/2005 3:44 PM 20.65 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_43907c41_00022551 12/2/2005 11:54 AM 17.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_4388a715_00057bcf 11/26/2005 1:19 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_4388f10d_000d59f8 11/26/2005 6:34 PM 7.64 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_438af275_0001e848 11/28/2005 7:05 AM 14.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_438f5e7b_000d9701 12/1/2005 3:38 PM 2.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_4390739b_0005b8d8 12/2/2005 11:17 AM 47 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_4388a728_0000f424 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_4388f140_0003d090 11/26/2005 6:36 PM 4.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_438af61b_00040d99 11/28/2005 7:20 AM 80.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_438f60e1_0007de29 12/1/2005 3:45 PM 66.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_43907c91_000aba95 12/2/2005 11:55 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_4388a763_000487ab 12/1/2005 2:58 PM 5.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_438908ec_000a4083 11/26/2005 8:16 PM 4.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_438af778_0003d090 11/28/2005 7:26 AM 36.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_438fb6ff_000aba95 12/1/2005 9:52 PM 3.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019da_4388af96_00081b32 11/26/2005 1:55 PM 56.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019da_438af9d7_0007270e 11/28/2005 7:36 AM 4.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019da_438fb903_0004c4b4 12/1/2005 10:01 PM 64.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_4388a6c1_0008583b 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_4388dc3a_00007a12 11/26/2005 5:05 PM 462 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_43892b5e_000e1113 11/26/2005 10:43 PM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_4389a4f5_0000f424 11/27/2005 7:22 AM 47.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_438a27ae_000c65d4 12/2/2005 11:54 AM 383 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_438a6814_000c28cb 11/27/2005 9:14 PM 869 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_438f579f_000501bd 12/1/2005 3:05 PM 536 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_43902ee2_00040d99 12/2/2005 6:24 AM 4.29 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_439063a8_000b34a7 12/2/2005 10:09 AM 21.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_439115cb_00089544 12/2/2005 10:49 PM 3.45 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_4388a6b5_000632ea 11/26/2005 1:17 PM 235 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_4388db9c_0005b8d8 11/26/2005 5:04 PM 62.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_43892a0e_00016e36 11/26/2005 10:37 PM 60.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_438a2797_00081b32 11/27/2005 4:39 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_438a6652_000d9701 11/27/2005 9:07 PM 20.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_438f55f5_000ca2dd 12/1/2005 2:58 PM 5.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_43902cfa_000ec82e 12/2/2005 6:16 AM 58.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_4390600b_00081b32 12/2/2005 9:54 AM 24.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_439114e2_0007270e 12/2/2005 10:45 PM 298 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_4388a742_0001312d 12/1/2005 2:58 PM 4.91 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_4388f2fc_00003d09 12/1/2005 10:06 PM 163.62 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_438af6d5_0009c671 11/28/2005 7:23 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_438fb6b3_0003d090 12/1/2005 9:51 PM 3.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001bd9_438fc611_0006acfc 12/1/2005 10:57 PM 50.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4388a6cb_000f0537 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4388dc66_000b71b0 11/26/2005 5:06 PM 5.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_43892c50_0009c671 11/26/2005 10:47 PM 4.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4389adc8_000b71b0 11/27/2005 7:59 AM 147.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_438a706e_00066ff3 11/27/2005 9:50 PM 3.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_438f587a_0008d24d 12/1/2005 3:09 PM 711 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_43902f99_000b71b0 12/2/2005 6:27 AM 12.60 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_439064be_0001e848 12/2/2005 10:14 AM 59.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4391174c_000e8b25 12/2/2005 10:55 PM 13.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cdf_438fc766_000a7d8c 12/1/2005 11:02 PM 3.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d11_438fbc9b_000f0537 12/1/2005 10:16 PM 4.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d18_4388af73_000d9701 11/26/2005 1:54 PM 43.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d18_438af9d7_00039387 11/28/2005 7:36 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d18_438fb8c5_000487ab 12/1/2005 10:00 PM 175.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_4388a765_000c28cb 11/26/2005 1:20 PM 1.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_438908fb_00000000 11/26/2005 8:16 PM 1.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_438af7a4_000a4083 11/28/2005 7:27 AM 38.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_438fb785_000e4e1c 12/1/2005 9:55 PM 3.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_4388a6b4_000c28cb 11/27/2005 4:39 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_4388db71_00022551 11/26/2005 5:04 PM 85.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438929eb_0000f424 11/26/2005 10:37 PM 63.55 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_4389a3be_000a037a 11/27/2005 7:17 AM 44.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438a2794_000632ea 11/27/2005 4:39 PM 242 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438a6649_00076417 11/27/2005 9:07 PM 5.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438f55f0_000dd40a 12/1/2005 2:58 PM 1.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_43902ca8_0002dc6c 12/2/2005 6:14 AM 8.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_43905fe0_000d1cef 12/2/2005 9:53 AM 5.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_439114e1_000b34a7 12/2/2005 10:45 PM 254 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001f16_438afbc5_000aba95 11/28/2005 7:44 AM 6.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001f16_438fba2b_0000f424 12/1/2005 10:06 PM 10.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_4388a73d_00098968 11/26/2005 1:19 PM 4.65 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_4388f2b8_000d59f8 11/26/2005 6:41 PM 62.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_438af6d3_00029f63 11/28/2005 7:23 AM 4.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_438f9a42_00089544 12/1/2005 7:50 PM 220.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002079_438fc6e9_000a037a 12/1/2005 11:00 PM 64.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_4388a6b9_0002dc6c 11/26/2005 1:17 PM 232 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_4388dbe6_000d59f8 11/26/2005 5:04 PM 5.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43892a86_00076417 11/26/2005 10:39 PM 82.34 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_4389a3f0_000632ea 11/27/2005 7:17 AM 40.62 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_438a279c_000cdfe6 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_438a6743_000af79e 11/27/2005 9:11 PM 80.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_438f5647_000ec82e 12/1/2005 3:00 PM 523 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43902d61_0002dc6c 12/2/2005 6:18 AM 814 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43906060_00094c5f 12/2/2005 9:55 AM 4.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43911514_00089544 12/2/2005 10:46 PM 53.82 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_4388a70f_000bebc2 11/26/2005 1:18 PM 313 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_4388f103_000a4083 11/26/2005 6:34 PM 15.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_43899f08_0006ea05 11/27/2005 6:56 AM 107.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_438af14f_000a037a 11/28/2005 7:00 AM 16.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_438f5e1f_0009c671 12/1/2005 3:33 PM 4.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_43907398_000a037a 12/2/2005 11:17 AM 13.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_4388a6c0_00053ec6 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_4388dc33_0007270e 11/26/2005 5:05 PM 5.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43892b50_0006acfc 11/26/2005 10:47 PM 95.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_4389a491_000d59f8 11/27/2005 7:20 AM 107.21 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_438a27a4_00053ec6 11/27/2005 4:39 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_438a67f8_00081b32 11/27/2005 9:14 PM 1.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_438f5736_00031975 12/1/2005 3:14 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43902e2c_00031975 12/2/2005 6:21 AM 64.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43906337_00000000 12/2/2005 10:07 AM 574 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43911580_000e8b25 12/2/2005 10:48 PM 71.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4388a6bf_00094c5f 11/26/2005 1:17 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4388dc33_0000b71b 11/26/2005 5:05 PM 1.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_43892b3a_000dd40a 11/26/2005 10:42 PM 89.21 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4389a485_0000f424 11/27/2005 7:20 AM 15.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_438a27a4_00029f63 11/27/2005 4:39 PM 235 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_438a67e6_0001e848 11/27/2005 9:13 PM 10.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_438f56f9_00090f56 12/1/2005 3:03 PM 563 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_43902e00_000d1cef 12/2/2005 6:20 AM 28.69 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_43906336_0004c4b4 12/2/2005 10:07 AM 550 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4391155e_00044aa2 12/2/2005 10:47 PM 11.73 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_4388a6f3_00007a12 11/26/2005 1:18 PM 1.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_4388e42a_000d59f8 11/26/2005 5:39 PM 25.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_43899e35_00090f56 11/27/2005 6:53 AM 169.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_4389b5f5_0009c671 11/27/2005 8:34 AM 35.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_438a7338_00090f56 11/27/2005 10:02 PM 1.29 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_438f5aed_0001ab3f 12/1/2005 3:23 PM 1.41 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_43906691_0006ea05 12/2/2005 10:21 AM 10.16 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000249e_4388a733_00003d09 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000249e_438af670_00090f56 11/28/2005 7:22 AM 79.75 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000249e_438f9701_00066ff3 12/1/2005 7:36 PM 112.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000251f_4388af4d_000cdfe6 11/26/2005 1:54 PM 63.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000251f_438af9d7_0001312d 11/28/2005 7:36 AM 4.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000251f_438fb8bd_00081b32 12/1/2005 10:00 PM 53.68 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002528_438fbca1_00016e36 12/1/2005 10:16 PM 76.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_4388a764_000501bd 11/26/2005 1:20 PM 232 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_438908f9_000aba95 11/26/2005 8:16 PM 15.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_438af794_0009c671 11/28/2005 7:27 AM 34.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_438fb75e_000e4e1c 12/1/2005 9:54 PM 3.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_4388a6b9_000f0537 11/27/2005 4:39 PM 6.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_4388dc19_00039387 11/26/2005 5:05 PM 28.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43892a9e_000b71b0 11/26/2005 10:40 PM 61.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_438a279d_0007de29 11/27/2005 4:39 PM 235 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_438a674b_000501bd 11/27/2005 9:11 PM 18.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_438f566a_000ec82e 12/1/2005 3:00 PM 345 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43902d67_00089544 12/2/2005 6:17 AM 21.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43906061_000e8b25 12/2/2005 9:55 AM 4.55 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43911519_000a7d8c 12/2/2005 10:46 PM 36.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_4388a713_000af79e 11/26/2005 1:18 PM 1.42 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_43899f27_000d9701 11/27/2005 6:57 AM 169.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_438af1ed_00007a12 11/28/2005 7:02 AM 13.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_438f5e20_000501bd 12/1/2005 3:36 PM 2.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_43907399_00090f56 12/2/2005 11:17 AM 47 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000263d_438fbb2e_0004c4b4 12/1/2005 10:10 PM 5.68 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002668_438fbc58_00044aa2 12/1/2005 10:15 PM 57.86 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_4388a6b1_000dd40a 11/26/2005 1:17 PM 510 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_4388dae4_000af79e 11/26/2005 5:00 PM 119.70 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438928f5_000632ea 11/26/2005 10:33 PM 442 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_4389a378_000cdfe6 11/27/2005 7:15 AM 47.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438a278e_000501bd 11/27/2005 4:39 PM 468 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438a660c_0007270e 11/27/2005 9:06 PM 102.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438f55de_00022551 12/1/2005 2:58 PM 5.83 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_43902c57_0003567e 12/2/2005 6:13 AM 56.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_43905f6c_0001e848 12/2/2005 9:51 AM 22.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_439113cf_0001312d 12/2/2005 10:41 PM 1.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026b1_438fc74f_000a037a 12/1/2005 11:02 PM 3.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_4388a6d7_00094c5f 11/26/2005 1:17 PM 1.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_4388ddbc_0000b71b 11/26/2005 5:12 PM 100.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_43892dc2_000dd40a 11/26/2005 10:53 PM 42.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_4389b31f_00000000 11/27/2005 8:22 AM 373 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_438a7126_000e8b25 11/27/2005 9:53 PM 1.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_438f5956_0006ea05 12/1/2005 3:16 PM 2.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_439065d3_000ca2dd 12/2/2005 10:18 AM 4 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4388a6a7_0006ea05 11/26/2005 1:17 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4388b0f2_000d1cef 11/26/2005 2:01 PM 58.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_43890dc6_0008d24d 11/26/2005 8:37 PM 75.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4389a16e_000c65d4 11/27/2005 7:07 AM 9.07 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4389f405_000aba95 11/27/2005 12:59 PM 8.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_438a5aac_000ec82e 11/27/2005 8:17 PM 5.89 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_438f182b_000aba95 12/1/2005 10:35 AM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4390288a_000a037a 12/2/2005 5:57 AM 3.57 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_43905cfc_000a7d8c 12/2/2005 9:41 AM 32.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4391119b_0007de29 12/2/2005 10:31 PM 41.70 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002725_438fbadd_0002625a 12/1/2005 10:09 PM 78.83 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000027da_438fc767_000aba95 12/1/2005 11:02 PM 5.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000282d_438fbbf6_00000000 12/1/2005 10:13 PM 16.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_4388a732_000501bd 11/26/2005 1:19 PM 355 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_4388f159_000e4e1c 11/26/2005 6:35 PM 495 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_438af664_00003d09 11/28/2005 7:21 AM 114.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_438f8ce2_0000f424 12/1/2005 6:53 PM 38.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_43907e52_000a4083 12/2/2005 12:03 PM 313.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002852_438fbab9_0002625a 12/1/2005 10:08 PM 55.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_4388a70c_00000000 11/26/2005 1:18 PM 323 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_4388f0f8_000dd40a 11/26/2005 6:34 PM 30.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_43899eee_0007a120 11/27/2005 6:56 AM 4.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_438af0f0_00089544 11/28/2005 6:58 AM 13.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_438f5db5_000cdfe6 12/1/2005 3:31 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_43907395_000d9701 12/2/2005 11:17 AM 105.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000028e2_438fc641_0003d090 12/1/2005 10:58 PM 48.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000293b_438fbc9a_000e8b25 12/1/2005 10:16 PM 13.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002959_438fbb96_00089544 12/1/2005 10:12 PM 15.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000029d8_438fbaf6_00031975 12/1/2005 10:09 PM 1.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002a38_438fbdd4_000e1113 12/1/2005 10:21 PM 27.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b00_4388a7d6_00039387 11/26/2005 1:22 PM 896 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b00_438af81a_000487ab 11/28/2005 7:29 AM 72.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b00_438fb7dd_00016e36 12/1/2005 9:56 PM 51.28 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b0c_4388a733_00090f56 11/26/2005 1:19 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b0c_4388f179_00053ec6 11/26/2005 6:36 PM 7 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b0c_438f9708_000a037a 12/1/2005 7:36 PM 999 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002ba5_438fc637_00029f63 12/1/2005 10:57 PM 55.12 KB Hidden from Windows API.
C:\Progr
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

Unread postby amateur » December 3rd, 2005, 1:59 pm

Hi Floete, :D

I am sorry that it didn't work again. :( I need to see the end of the Rootkit Revealer log, it was cut off when you did post it. After all the lines with C:\Program Files\Newnvu\ there should be some other lines (2 or 3) I need you to post those lines.

I would like to know why you can't export/see those lines in Safe Mode. Please reboot your computer in Safe Mode, Go to Start and click on Run. A small window will open. Type "Regedit" in that window and click OK. Then, Click on the + sign on HKLM, on the drop down menu, click on + Software. Find the entry C1iesAC9ZXtm and select it by clicking on it. Go to File > Export and save that export to a convenient location. Name it myexport. Locate the file myexport.reg and rename it to myexport.txt and post the content of that file. If you dont see the C1iesAC9ZXtm key in the registry, log in under another account in Safe Mode and try again. Let me know if you see that HKLM\SOFTWARE\C1iesAC9ZXtm key.
Please remember to perform this in Safe Mode.
Are you able to boot in Safe Mode since it isn't normal that the regexport doesn't work?

This is how you log in Safe Mode:

reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, tap lightly several times on F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the Safe Mode.
User avatar
amateur
MRU Master
MRU Master
 
Posts: 2545
Joined: September 25th, 2005, 1:13 pm
Location: RI, USA

Unread postby floete » December 6th, 2005, 11:30 am

here's the rootkit log. rest of stuff later ...

HKLM\SOFTWARE\C1iesAC9ZXtm 12/2/2005 11:03 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDRMGMT 11/25/2005 12:55 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\Cdrmgmt 12/2/2005 11:08 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu 12/2/2005 5:50 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\ace.dll 11/25/2005 12:56 PM 568.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\AI_01-12-2005.log 12/1/2005 6:09 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_02-12-2005.log 12/2/2005 5:50 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_26-11-2005.log 11/26/2005 6:25 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_27-11-2005.log 11/27/2005 12:00 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_28-11-2005.log 11/28/2005 12:00 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_29-11-2005.log 11/29/2005 6:29 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\AI_30-11-2005.log 11/30/2005 7:24 AM 3 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache 12/2/2005 11:12 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4388a551_000e1113 12/2/2005 11:10 PM 34.62 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4388afc8_000c65d4 11/26/2005 1:56 PM 52.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43890ce9_0004c4b4 11/26/2005 8:33 PM 43.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43899f86_000ec82e 11/27/2005 6:59 AM 65.25 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4389f1b3_00016e36 11/27/2005 12:49 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_438a5a68_00057bcf 11/27/2005 8:16 PM 60.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_438f060e_0003c1ae 12/1/2005 9:17 AM 112.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_438f179c_000e8b25 12/1/2005 10:32 AM 483 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_439027d3_0007de29 12/2/2005 5:54 AM 38.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43908066_0006ea05 12/2/2005 12:12 PM 313.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4390c1de_000487ab 12/2/2005 4:51 PM 3.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_43911ad2_000bebc2 12/2/2005 11:10 PM 340.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_4388a73f_00029f63 11/26/2005 1:19 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_4388f2cd_0007270e 11/26/2005 6:42 PM 19.19 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_438af6d3_00089544 11/28/2005 7:23 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000035_438fb698_000d59f8 12/1/2005 9:51 PM 4.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_4388a6aa_000487ab 11/27/2005 4:39 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_4388da3a_00003d09 11/26/2005 4:57 PM 42.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_4389a1f1_0007a120 11/27/2005 7:09 AM 71.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_438a2776_00081b32 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_438a5aba_000c28cb 11/27/2005 8:17 PM 4.96 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_438f1836_00007a12 12/2/2005 10:06 AM 2.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_43902958_0004c4b4 12/2/2005 6:00 AM 44.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_43905d6c_00039387 12/2/2005 9:43 AM 4.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000099_43911263_000d1cef 12/2/2005 10:34 PM 59.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000000c1_438fbcdd_000a7d8c 12/1/2005 10:17 PM 9.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4388a6be_00007a12 11/26/2005 1:17 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4388dc32_000ca2dd 11/26/2005 5:05 PM 408 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_43892b03_000baeb9 12/1/2005 10:01 PM 15.64 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4389a47d_00066ff3 11/27/2005 7:20 AM 14.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_438a27a3_0004c4b4 11/27/2005 4:39 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_438a67df_000501bd 11/27/2005 9:15 PM 37.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_438f56f4_000af79e 12/1/2005 3:06 PM 2.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_43902dff_00053ec6 12/2/2005 6:20 AM 33.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_4390630c_0007de29 12/2/2005 10:06 AM 316 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000120_43911556_000c28cb 12/2/2005 10:47 PM 26.60 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_4388a6aa_0009c671 11/26/2005 1:17 PM 303 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_4388da47_0002dc6c 11/26/2005 4:57 PM 27.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438922bd_00022551 11/26/2005 10:06 PM 4.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_4389a219_00016e36 11/27/2005 7:10 AM 97.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438a2777_0008583b 11/27/2005 4:39 PM 302 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438a6377_0001312d 11/27/2005 8:55 PM 59.10 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_438f1836_0007de29 12/1/2005 10:35 AM 3.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_43902964_00090f56 12/2/2005 6:00 AM 44.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_43905d74_000d1cef 12/2/2005 9:43 AM 19.73 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000124_43911280_000bebc2 12/2/2005 10:43 PM 77.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_4388a747_000bebc2 11/26/2005 1:19 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_4388f574_00029f63 11/26/2005 6:53 PM 9.86 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_438af700_0001312d 11/28/2005 7:24 AM 35.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001d3_438fb6b4_00090f56 12/2/2005 6:05 AM 137.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001e1_438fc5e9_000a037a 12/1/2005 10:56 PM 11.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_4388a6a7_0008d24d 11/27/2005 4:38 PM 468 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_4388b117_000dd40a 12/2/2005 10:30 PM 41.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_43890dce_0001312d 11/26/2005 10:39 PM 78.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_4389a181_000baeb9 11/27/2005 7:07 AM 12.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_438a5aaf_000632ea 11/27/2005 8:17 PM 15.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_438f182c_0000f424 12/1/2005 10:35 AM 586 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_43902894_0003d090 12/2/2005 5:57 AM 6.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_43905d01_00066ff3 12/2/2005 9:41 AM 28.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000001eb_439111b9_00098968 12/2/2005 10:34 PM 6.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4388a6bb_000ca2dd 11/26/2005 1:17 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4388dc2b_000e4e1c 11/26/2005 5:05 PM 1.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_43892ab7_000d1cef 11/26/2005 10:40 PM 60.50 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4389a3fc_00031975 11/27/2005 7:18 AM 1.58 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_438a279f_00007a12 11/27/2005 4:39 PM 413 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_438a6791_0001ab3f 11/27/2005 9:12 PM 85.69 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_438f5688_0008583b 12/1/2005 3:01 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_43902db4_000d59f8 12/2/2005 6:19 AM 37.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_43906077_0006acfc 12/2/2005 9:55 AM 41.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000030a_4391151d_000d59f8 12/2/2005 10:46 PM 4 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_4388a71a_0003d090 11/26/2005 1:19 PM 510 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_438af2d0_000a037a 11/28/2005 7:06 AM 10.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_438f609a_000501bd 12/1/2005 3:44 PM 1.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000384_43907c2e_00057bcf 12/2/2005 11:54 AM 21.36 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000390_438fbdbf_0001ab3f 12/1/2005 10:21 PM 29.42 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_4388a6fd_0008d24d 11/26/2005 1:18 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_4388eaf7_000cdfe6 11/26/2005 6:08 PM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_43899ee6_0007de29 11/27/2005 6:57 AM 2.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_4389b908_0005f5e1 11/27/2005 8:47 AM 173.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_438a7366_000a4083 11/27/2005 10:03 PM 160.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_438f5bfb_0008d24d 12/1/2005 3:24 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000047e_43906704_0005b8d8 12/2/2005 10:23 AM 109.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000588_438fbaad_000aba95 12/1/2005 10:08 PM 13.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000633_4388af40_0002625a 11/27/2005 8:53 PM 937 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000633_438af9d5_000a037a 11/28/2005 7:36 AM 2.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000633_438fb892_0002625a 12/1/2005 9:59 PM 62.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_4388a724_00089544 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_4388f12b_00040d99 11/26/2005 6:35 PM 254 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_438af56c_000e4e1c 11/28/2005 7:17 AM 89.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_438f609c_0006acfc 12/1/2005 3:44 PM 378 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000677_43907c36_0007de29 12/2/2005 11:54 AM 17.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000728_438fc58f_00031975 12/1/2005 10:54 PM 1.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4388a6bd_000af79e 11/26/2005 1:17 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4388dc32_000baeb9 11/26/2005 5:05 PM 407 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_43892b02_000632ea 11/26/2005 10:41 PM 126.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4389a419_000487ab 11/27/2005 7:18 AM 23.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_438a27a2_000ec82e 11/27/2005 4:39 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_438a67db_000c65d4 11/27/2005 9:13 PM 36.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_438f56f2_000a7d8c 12/1/2005 3:02 PM 6.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_43902dfe_00098968 12/2/2005 6:20 AM 6.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_4390607a_0008583b 12/2/2005 9:55 AM 4.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000732_43911554_000e4e1c 12/2/2005 10:47 PM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_4388a6b0_000a037a 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_4388daa2_0006acfc 11/26/2005 4:58 PM 8.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438928ed_000af79e 11/26/2005 10:33 PM 254 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_4389a2f7_000b71b0 11/27/2005 7:13 AM 288.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438a2786_000a4083 11/27/2005 4:39 PM 724 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438a6518_000a4083 11/27/2005 9:02 PM 4.19 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_438f55c2_0008583b 12/1/2005 2:57 PM 239 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_43902c39_000f0537 12/2/2005 6:12 AM 11.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_43905e2e_0007a120 12/2/2005 9:46 AM 52.34 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000074d_43911340_000aba95 12/2/2005 10:38 PM 77.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_4388a73f_00076417 11/26/2005 1:19 PM 711 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_4388f2d5_000b34a7 11/26/2005 6:42 PM 117.67 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_438af6d3_000a037a 11/28/2005 7:23 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000007cf_438fb6a3_000b71b0 12/2/2005 9:45 AM 52.82 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4388a6d0_000b34a7 11/26/2005 1:17 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4388dcc8_0005f5e1 11/26/2005 5:08 PM 402 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4389b2cf_00098968 12/1/2005 9:50 PM 21.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_438a70b2_000dd40a 11/27/2005 9:51 PM 8.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_438f5928_000af79e 12/1/2005 3:12 PM 711 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_4390303b_0002625a 12/2/2005 6:30 AM 88.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000822_43906589_000ca2dd 12/2/2005 10:17 AM 53.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000086a_438fbc6c_00040d99 12/1/2005 10:15 PM 9.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000871_438fc61b_00076417 12/1/2005 10:57 PM 48.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000878_438fc727_0008583b 12/1/2005 11:01 PM 48.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_4388a6dd_000e4e1c 11/26/2005 1:18 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_4388ddbc_00053ec6 11/26/2005 5:12 PM 466 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_43892e8d_000bebc2 11/27/2005 7:02 AM 13.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_4389b329_0007a120 11/27/2005 8:22 AM 1.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_438a7179_00016e36 11/27/2005 9:54 PM 4.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_438f596f_000af79e 12/1/2005 3:13 PM 248 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000902_439065eb_0001ab3f 12/2/2005 10:19 AM 43.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000940_438fbc7d_00076417 12/1/2005 10:16 PM 4.55 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_4388a759_000e1113 12/2/2005 11:10 PM 214.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_438908e9_00031975 11/26/2005 8:16 PM 5.29 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_438af751_0008d24d 11/28/2005 7:25 AM 39.89 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000975_438fb6f0_000b34a7 12/1/2005 9:52 PM 3.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000009ce_438fbaf6_00090f56 12/1/2005 10:09 PM 3.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000a28_438fbaf6_0007270e 12/1/2005 10:09 PM 1.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000a4a_438fba4a_000501bd 12/1/2005 10:06 PM 8.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_4388a6a7_0009c671 11/26/2005 1:17 PM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_4388b11d_000a4083 11/26/2005 2:01 PM 51.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_4389a19b_000d1cef 11/27/2005 7:07 AM 30.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_438a276f_000af79e 11/27/2005 4:38 PM 361.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_438a5ab0_00089544 11/27/2005 8:17 PM 11.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_438f1834_0002625a 12/1/2005 10:35 AM 316 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_43902898_0008d24d 12/2/2005 5:57 AM 3.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_43905d07_0000b71b 12/2/2005 9:41 AM 143.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bb3_439111d2_000e4e1c 12/2/2005 10:32 PM 98.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_4388a6bc_000a4083 11/27/2005 4:39 PM 4.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_4388dc32_0003d090 11/26/2005 5:05 PM 36.07 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_43892ae0_00031975 11/26/2005 10:41 PM 40.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_438a279f_00094c5f 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_438a67b8_000ca2dd 11/27/2005 9:13 PM 32.57 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_438f56b0_000f0537 12/1/2005 3:01 PM 600 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_43902dfd_00000000 12/2/2005 6:20 AM 33.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_43906078_000b71b0 12/2/2005 9:55 AM 417 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000bdb_4391153a_00090f56 12/2/2005 10:47 PM 5.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c15_4388af3f_0009c671 11/27/2005 8:53 PM 937 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c15_438af988_000d9701 11/28/2005 7:35 AM 20.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c15_438fb82a_00040d99 12/1/2005 9:57 PM 60.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c7b_4388af3e_00053ec6 11/26/2005 1:53 PM 937 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c7b_438af8c6_0002625a 11/28/2005 7:46 AM 71.75 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000c7b_438fb7eb_000b34a7 12/1/2005 9:56 PM 56.19 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ce1_438fbcde_0008583b 12/1/2005 10:17 PM 4.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_4388a702_00076417 11/26/2005 1:18 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_4388eb1c_00044aa2 12/2/2005 4:52 PM 8.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_43899ee9_000bebc2 11/27/2005 6:57 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_438a73d4_0004c4b4 11/27/2005 10:04 PM 2.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_438f5c1a_0000f424 12/1/2005 3:24 PM 4.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d66_4390675d_0001312d 12/2/2005 10:25 AM 70.10 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000d6a_438fbc9b_00029f63 12/1/2005 10:16 PM 49.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4388a6c4_0003d090 11/26/2005 1:17 PM 468 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4388dc50_000c65d4 11/26/2005 5:06 PM 1.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_43892b82_0004c4b4 11/26/2005 10:44 PM 4.50 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4389aca3_000e1113 11/27/2005 7:54 AM 352.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_438a700a_0003567e 11/27/2005 9:48 PM 117.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_438f57f7_0002dc6c 12/1/2005 3:07 PM 635 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_43902f54_0007a120 12/2/2005 6:26 AM 59.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_43906429_000d1cef 12/2/2005 10:11 AM 6.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ddc_4391166a_00053ec6 12/2/2005 10:52 PM 70.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000de5_438fbaec_0006ea05 12/1/2005 10:09 PM 15.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_4388a72b_00076417 11/26/2005 1:19 PM 510 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_438af649_00057bcf 11/28/2005 7:21 AM 85.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_438f899a_00094c5f 12/1/2005 6:39 PM 35.70 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e12_43907cb4_000a037a 12/2/2005 11:56 AM 46.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e29_438fc789_000c28cb 12/1/2005 11:03 PM 2.41 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_4388a748_0007a120 11/26/2005 1:19 PM 678 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_4388f58f_000501bd 11/26/2005 6:53 PM 22.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_438af70b_000e1113 11/28/2005 7:24 AM 35.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000e90_438fb6e1_000d9701 12/2/2005 9:45 AM 53.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ea9_438fbcb3_000c28cb 12/1/2005 10:17 PM 4.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_4388a747_00040d99 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_4388f30d_0001312d 11/26/2005 6:43 PM 32.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_438af6d9_0000b71b 11/28/2005 7:23 AM 80.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000ecc_438fb6b3_000ca2dd 12/1/2005 9:51 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4388a6aa_0002625a 11/26/2005 1:17 PM 38.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4388da13_0001ab3f 11/26/2005 4:56 PM 20.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_43892240_00016e36 11/26/2005 10:04 PM 261.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4389a1ec_0001312d 11/27/2005 7:09 AM 26.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_438a2775_0008583b 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_438a5aba_0009c671 11/27/2005 8:17 PM 2.80 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_438f1835_000a4083 12/1/2005 10:35 AM 1.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_4390294f_000c28cb 12/2/2005 6:00 AM 4 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_43905d67_000c65d4 12/2/2005 9:42 AM 104.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000f3e_43911248_0009c671 12/2/2005 10:34 PM 100.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_4388a6f6_0009c671 11/26/2005 1:18 PM 492 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_4388ea53_00016e36 11/26/2005 6:05 PM 39.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_43899eba_0005b8d8 11/27/2005 6:55 AM 802 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_4389b856_0009c671 11/27/2005 8:44 AM 149.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_438a734d_00016e36 11/27/2005 10:02 PM 2.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_438f5bb0_0001ab3f 12/1/2005 3:23 PM 618 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fbf_439066d8_00003d09 12/2/2005 10:23 AM 64.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_4388a72b_0001e848 11/26/2005 1:19 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_4388f14a_0009c671 11/26/2005 6:35 PM 26.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_438af639_00057bcf 11/28/2005 7:21 AM 122.97 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_438f8990_0002dc6c 12/1/2005 6:38 PM 112.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000fc9_43907cae_000632ea 12/2/2005 11:56 AM 36.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001030_438fc5f1_0003d090 12/1/2005 10:56 PM 48.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001049_438fbc6b_000dd40a 12/1/2005 10:15 PM 48.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000010d9_438fbd7c_00000000 12/1/2005 10:20 PM 26.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000010d9_438fc5a3_000f0537 12/1/2005 10:55 PM 550 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000117a_438fc6fc_0001312d 12/1/2005 11:01 PM 48.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_4388a734_00016e36 11/26/2005 1:19 PM 4.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_4388f17e_000bebc2 11/26/2005 6:36 PM 5.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_438af69e_000e8b25 11/28/2005 7:22 AM 119.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000011f4_438f9718_000e8b25 12/1/2005 7:36 PM 391.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_4388a6d5_000b71b0 11/27/2005 4:39 PM 800 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_4388ddbb_0002dc6c 11/26/2005 5:12 PM 383 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_43892d80_0005b8d8 11/26/2005 10:52 PM 603 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_4389b310_000c28cb 11/27/2005 8:22 AM 2.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_438a70e8_0006ea05 11/27/2005 9:52 PM 4.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_438f5954_000e1113 12/1/2005 3:28 PM 519 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000121f_439065cd_0001e848 12/2/2005 10:18 AM 32.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_4388a6b4_0003567e 11/26/2005 1:17 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_4388db5b_000bebc2 11/26/2005 5:02 PM 93.21 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438929be_000a4083 11/26/2005 10:36 PM 63.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_4389a3b8_0001e848 11/27/2005 7:16 AM 1.58 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438a2793_000b34a7 11/27/2005 4:39 PM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438a6620_0009c671 11/27/2005 9:06 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_438f55ef_000f0537 12/1/2005 2:58 PM 237 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_43902c9d_0008d24d 12/2/2005 6:14 AM 64 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001238_439114da_00003d09 12/2/2005 10:48 PM 77.57 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_4388a73e_00076417 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_4388f2ca_0001ab3f 11/26/2005 6:42 PM 169.69 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_438af6d3_00039387 11/28/2005 7:23 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000127e_438fb698_000a037a 12/1/2005 9:51 PM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4388a6a8_000501bd 11/26/2005 1:17 PM 724 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4388b139_000632ea 11/26/2005 2:02 PM 74.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438921ac_000aba95 11/26/2005 10:02 PM 150.16 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4389a1bc_000487ab 12/2/2005 9:50 AM 37.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438a2772_000e1113 11/27/2005 4:39 PM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438a5ab2_0005b8d8 11/27/2005 8:17 PM 32.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_438f1834_0005b8d8 12/2/2005 10:06 AM 197 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_4390292e_00089544 12/2/2005 5:59 AM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_43905d2c_00029f63 12/2/2005 9:41 AM 213.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012db_439111e2_00003d09 12/2/2005 10:32 PM 98.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_4388a6d4_0006ea05 11/26/2005 1:17 PM 413 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_4388dcc9_0002dc6c 11/26/2005 5:08 PM 1.65 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_43892d7c_0001ab3f 11/26/2005 10:52 PM 19.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_4389b301_00076417 11/27/2005 8:22 AM 136.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_438a70db_0001312d 11/27/2005 9:52 PM 5.28 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_438f592b_0007de29 12/1/2005 3:12 PM 653 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000012e1_439065ae_000b71b0 12/2/2005 10:18 AM 6.81 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001316_438afded_00016e36 11/28/2005 7:54 AM 260.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001316_438fba9f_0008583b 12/1/2005 10:08 PM 1.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_4388a6c8_000c28cb 11/26/2005 1:17 PM 73.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_4388dc66_0005f5e1 11/26/2005 5:06 PM 1.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43892c45_00016e36 11/26/2005 10:47 PM 24.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_4389adbf_0007de29 11/27/2005 7:59 AM 50.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_438a706d_00076417 12/2/2005 9:45 AM 428 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_438f587a_00022551 12/1/2005 3:12 PM 1.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43902f95_0005b8d8 12/2/2005 6:27 AM 21.01 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43906492_000dd40a 12/2/2005 10:13 AM 18.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001366_43911749_00016e36 12/2/2005 10:55 PM 17.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000138a_438fbb93_000e4e1c 12/1/2005 10:12 PM 55.68 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_4388a6e0_000ec82e 11/26/2005 1:18 PM 1.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_4388debe_000501bd 11/26/2005 5:16 PM 427 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_43892ea4_0005b8d8 11/26/2005 10:57 PM 148 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_4389b3b4_000d9701 11/27/2005 8:25 AM 361.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_438a7205_0003567e 11/27/2005 9:57 PM 86.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_438f59b3_000e1113 12/1/2005 3:14 PM 6.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000139d_43906606_000d59f8 12/2/2005 10:19 AM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013d3_438fbaf5_000ca2dd 12/1/2005 10:09 PM 3.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_4388a6eb_000c65d4 11/26/2005 1:18 PM 1.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_4388e26a_000aba95 11/27/2005 7:13 AM 100.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_43892fb4_000a4083 11/26/2005 11:02 PM 57.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_4389b49d_00029f63 11/27/2005 8:29 AM 53.86 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_438a7326_000b34a7 11/27/2005 10:01 PM 16.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_438f5a88_00022551 12/1/2005 3:18 PM 7.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000013e9_43906674_0009c671 12/2/2005 10:21 AM 70.25 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001481_4388a772_0003567e 11/27/2005 4:39 PM 1.07 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001481_438af7d0_000e8b25 11/28/2005 7:28 AM 40.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001481_438fb7a8_000ca2dd 12/1/2005 9:55 PM 1.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4388a6a8_0008d24d 11/26/2005 1:17 PM 634 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4388d9ed_000cdfe6 11/26/2005 4:55 PM 18.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438921c1_00044aa2 11/26/2005 10:02 PM 78.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4389a1ce_0007de29 11/27/2005 7:08 AM 30.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438a2773_000a037a 11/27/2005 4:39 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438a5ab6_000f0537 11/27/2005 8:17 PM 1.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_438f1834_0007de29 12/1/2005 10:35 AM 993 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4390294e_000c65d4 12/2/2005 6:00 AM 274 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_43905d32_000ca2dd 12/2/2005 9:41 AM 12.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000153c_4391120c_000d59f8 12/2/2005 10:33 PM 75.96 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_4388a6af_000e1113 11/26/2005 1:17 PM 17.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_4388da7c_000d1cef 11/26/2005 4:58 PM 7.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438928b3_000a7d8c 11/26/2005 10:32 PM 43.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_4389a29d_000cdfe6 11/27/2005 7:12 AM 38.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438a2780_0008d24d 11/27/2005 4:39 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438a64b5_0005b8d8 11/27/2005 9:00 PM 88.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_438f55bb_0009c671 12/1/2005 2:57 PM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_43902c34_00003d09 12/2/2005 6:12 AM 426 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_43905e04_000dd40a 12/2/2005 9:45 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001547_439112ae_00076417 12/2/2005 10:36 PM 1.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000159f_438fc622_0007a120 12/1/2005 10:58 PM 60.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4388a6cf_0007de29 11/26/2005 1:17 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4388dcb8_000cdfe6 11/26/2005 5:07 PM 462 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_43892d3a_0003d090 11/26/2005 10:52 PM 29.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4389af31_0003d090 11/27/2005 8:05 AM 3.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_438a708a_0006ea05 11/27/2005 9:50 PM 7.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_438f58d2_00039387 12/1/2005 3:10 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4390301a_00029f63 12/2/2005 6:29 AM 167.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_4390650e_0007a120 12/2/2005 10:17 AM 31.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000015a1_43911809_00076417 12/2/2005 10:59 PM 380.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001643_438fbae9_00044aa2 12/1/2005 10:11 PM 62.10 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4388a6a4_000632ea 11/27/2005 4:38 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4388b0d9_0000b71b 11/26/2005 2:00 PM 473 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43890d80_000baeb9 11/26/2005 8:36 PM 81.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4389a12f_0005f5e1 11/27/2005 7:06 AM 84.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_4389f37f_0007de29 11/27/2005 12:57 PM 28.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_438a5aa7_00007a12 11/27/2005 8:17 PM 786 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_438f0691_000a6eaa 12/1/2005 9:20 AM 97 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_438f17de_00094c5f 12/1/2005 10:33 AM 1.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43902852_0006ea05 12/2/2005 5:56 AM 3.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43905cab_0005b8d8 12/2/2005 9:39 AM 8.72 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001649_43911180_000d1cef 12/2/2005 10:31 PM 76.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000169a_438fbd57_00039387 12/1/2005 10:19 PM 37.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_4388a6e8_00053ec6 11/26/2005 1:18 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_4388e263_000aba95 12/2/2005 6:00 AM 282.06 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_43892f0d_0000f424 11/26/2005 10:59 PM 33.49 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_4389b3fd_00081b32 11/27/2005 4:40 PM 40.34 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_438a72c8_0002625a 11/27/2005 10:00 PM 87.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_438f5a44_0009c671 12/1/2005 3:17 PM 1.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016c5_43906611_0002dc6c 12/2/2005 10:19 AM 15.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016d4_4388a7df_00016e36 12/2/2005 10:35 AM 7.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016d4_438af84f_00098968 11/28/2005 7:30 AM 67.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000016d4_438fb7e3_00089544 12/1/2005 9:56 PM 3.45 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001796_438afb9f_0007de29 11/28/2005 7:44 AM 110.59 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001796_438fba0a_000d59f8 12/1/2005 10:05 PM 4.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000182f_438afc1d_0008d24d 11/28/2005 7:46 AM 67.73 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000182f_438fba2b_0008d24d 12/1/2005 10:06 PM 7.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001850_4388a7d5_000ec82e 11/26/2005 1:22 PM 20.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001850_438af7ec_0000f424 11/28/2005 7:28 AM 12.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001850_438fb7b6_0007270e 12/1/2005 9:55 PM 54.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4388a6e6_000e1113 11/26/2005 1:18 PM 1.16 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4388e25c_00098968 12/2/2005 6:00 AM 170.97 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_43892ee9_000d59f8 11/26/2005 10:58 PM 39.63 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4389b3f2_000d1cef 11/27/2005 4:39 PM 1.41 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_438a728b_00031975 11/27/2005 9:59 PM 18.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_438f5a42_000a4083 12/1/2005 3:17 PM 1.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000187e_4390660e_000a7d8c 12/2/2005 10:19 AM 47.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4388a611_000aba95 12/2/2005 6:22 AM 248.64 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4388afcc_000e4e1c 11/26/2005 1:56 PM 90.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_43890d4a_000e8b25 11/26/2005 8:35 PM 39.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_43899ffe_00044aa2 12/1/2005 7:50 PM 69.36 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4389f1cf_00098968 11/27/2005 12:50 PM 676 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_438a5a83_0001ab3f 11/27/2005 8:16 PM 1.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_438f17b2_000e4e1c 12/1/2005 10:55 PM 90.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_439027f4_00003d09 12/2/2005 5:54 AM 3.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_439080ab_0009c671 12/2/2005 12:13 PM 325.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018be_4390c201_000baeb9 12/2/2005 4:59 PM 7.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_4388a725_000632ea 11/26/2005 1:19 PM 211 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_4388f12c_00031975 11/26/2005 6:35 PM 1.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_438af5cb_00040d99 11/28/2005 7:19 AM 81.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_438f60ba_000632ea 12/1/2005 3:44 PM 20.65 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000018d7_43907c41_00022551 12/2/2005 11:54 AM 17.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_4388a715_00057bcf 11/26/2005 1:19 PM 602 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_4388f10d_000d59f8 11/26/2005 6:34 PM 7.64 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_438af275_0001e848 11/28/2005 7:05 AM 14.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_438f5e7b_000d9701 12/1/2005 3:38 PM 2.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001916_4390739b_0005b8d8 12/2/2005 11:17 AM 47 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_4388a728_0000f424 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_4388f140_0003d090 11/26/2005 6:36 PM 4.95 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_438af61b_00040d99 11/28/2005 7:20 AM 80.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_438f60e1_0007de29 12/1/2005 3:45 PM 66.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001953_43907c91_000aba95 12/2/2005 11:55 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_4388a763_000487ab 12/1/2005 2:58 PM 5.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_438908ec_000a4083 11/26/2005 8:16 PM 4.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_438af778_0003d090 11/28/2005 7:26 AM 36.71 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019d9_438fb6ff_000aba95 12/1/2005 9:52 PM 3.54 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019da_4388af96_00081b32 11/26/2005 1:55 PM 56.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019da_438af9d7_0007270e 11/28/2005 7:36 AM 4.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000019da_438fb903_0004c4b4 12/1/2005 10:01 PM 64.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_4388a6c1_0008583b 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_4388dc3a_00007a12 11/26/2005 5:05 PM 462 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_43892b5e_000e1113 11/26/2005 10:43 PM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_4389a4f5_0000f424 11/27/2005 7:22 AM 47.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_438a27ae_000c65d4 12/2/2005 11:54 AM 383 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_438a6814_000c28cb 11/27/2005 9:14 PM 869 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_438f579f_000501bd 12/1/2005 3:05 PM 536 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_43902ee2_00040d99 12/2/2005 6:24 AM 4.29 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_439063a8_000b34a7 12/2/2005 10:09 AM 21.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001a49_439115cb_00089544 12/2/2005 10:49 PM 3.45 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_4388a6b5_000632ea 11/26/2005 1:17 PM 235 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_4388db9c_0005b8d8 11/26/2005 5:04 PM 62.88 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_43892a0e_00016e36 11/26/2005 10:37 PM 60.87 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_438a2797_00081b32 11/27/2005 4:39 PM 226 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_438a6652_000d9701 11/27/2005 9:07 PM 20.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_438f55f5_000ca2dd 12/1/2005 2:58 PM 5.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_43902cfa_000ec82e 12/2/2005 6:16 AM 58.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_4390600b_00081b32 12/2/2005 9:54 AM 24.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001ad4_439114e2_0007270e 12/2/2005 10:45 PM 298 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_4388a742_0001312d 12/1/2005 2:58 PM 4.91 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_4388f2fc_00003d09 12/1/2005 10:06 PM 163.62 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_438af6d5_0009c671 11/28/2005 7:23 AM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001af4_438fb6b3_0003d090 12/1/2005 9:51 PM 3.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001bd9_438fc611_0006acfc 12/1/2005 10:57 PM 50.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4388a6cb_000f0537 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4388dc66_000b71b0 11/26/2005 5:06 PM 5.23 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_43892c50_0009c671 11/26/2005 10:47 PM 4.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4389adc8_000b71b0 11/27/2005 7:59 AM 147.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_438a706e_00066ff3 11/27/2005 9:50 PM 3.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_438f587a_0008d24d 12/1/2005 3:09 PM 711 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_43902f99_000b71b0 12/2/2005 6:27 AM 12.60 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_439064be_0001e848 12/2/2005 10:14 AM 59.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cd0_4391174c_000e8b25 12/2/2005 10:55 PM 13.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001cdf_438fc766_000a7d8c 12/1/2005 11:02 PM 3.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d11_438fbc9b_000f0537 12/1/2005 10:16 PM 4.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d18_4388af73_000d9701 11/26/2005 1:54 PM 43.74 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d18_438af9d7_00039387 11/28/2005 7:36 AM 36 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001d18_438fb8c5_000487ab 12/1/2005 10:00 PM 175.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_4388a765_000c28cb 11/26/2005 1:20 PM 1.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_438908fb_00000000 11/26/2005 8:16 PM 1.40 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_438af7a4_000a4083 11/28/2005 7:27 AM 38.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001dc0_438fb785_000e4e1c 12/1/2005 9:55 PM 3.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_4388a6b4_000c28cb 11/27/2005 4:39 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_4388db71_00022551 11/26/2005 5:04 PM 85.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438929eb_0000f424 11/26/2005 10:37 PM 63.55 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_4389a3be_000a037a 11/27/2005 7:17 AM 44.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438a2794_000632ea 11/27/2005 4:39 PM 242 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438a6649_00076417 11/27/2005 9:07 PM 5.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_438f55f0_000dd40a 12/1/2005 2:58 PM 1.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_43902ca8_0002dc6c 12/2/2005 6:14 AM 8.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_43905fe0_000d1cef 12/2/2005 9:53 AM 5.38 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001e1f_439114e1_000b34a7 12/2/2005 10:45 PM 254 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001f16_438afbc5_000aba95 11/28/2005 7:44 AM 6.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00001f16_438fba2b_0000f424 12/1/2005 10:06 PM 10.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_4388a73d_00098968 11/26/2005 1:19 PM 4.65 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_4388f2b8_000d59f8 11/26/2005 6:41 PM 62.93 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_438af6d3_00029f63 11/28/2005 7:23 AM 4.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002059_438f9a42_00089544 12/1/2005 7:50 PM 220.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002079_438fc6e9_000a037a 12/1/2005 11:00 PM 64.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_4388a6b9_0002dc6c 11/26/2005 1:17 PM 232 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_4388dbe6_000d59f8 11/26/2005 5:04 PM 5.47 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43892a86_00076417 11/26/2005 10:39 PM 82.34 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_4389a3f0_000632ea 11/27/2005 7:17 AM 40.62 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_438a279c_000cdfe6 11/27/2005 4:39 PM 354 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_438a6743_000af79e 11/27/2005 9:11 PM 80.77 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_438f5647_000ec82e 12/1/2005 3:00 PM 523 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43902d61_0002dc6c 12/2/2005 6:18 AM 814 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43906060_00094c5f 12/2/2005 9:55 AM 4.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002213_43911514_00089544 12/2/2005 10:46 PM 53.82 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_4388a70f_000bebc2 11/26/2005 1:18 PM 313 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_4388f103_000a4083 11/26/2005 6:34 PM 15.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_43899f08_0006ea05 11/27/2005 6:56 AM 107.26 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_438af14f_000a037a 11/28/2005 7:00 AM 16.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_438f5e1f_0009c671 12/1/2005 3:33 PM 4.43 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022cd_43907398_000a037a 12/2/2005 11:17 AM 13.39 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_4388a6c0_00053ec6 11/26/2005 1:17 PM 453 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_4388dc33_0007270e 11/26/2005 5:05 PM 5.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43892b50_0006acfc 11/26/2005 10:47 PM 95.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_4389a491_000d59f8 11/27/2005 7:20 AM 107.21 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_438a27a4_00053ec6 11/27/2005 4:39 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_438a67f8_00081b32 11/27/2005 9:14 PM 1.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_438f5736_00031975 12/1/2005 3:14 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43902e2c_00031975 12/2/2005 6:21 AM 64.04 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43906337_00000000 12/2/2005 10:07 AM 574 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000022ee_43911580_000e8b25 12/2/2005 10:48 PM 71.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4388a6bf_00094c5f 11/26/2005 1:17 PM 455 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4388dc33_0000b71b 11/26/2005 5:05 PM 1.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_43892b3a_000dd40a 11/26/2005 10:42 PM 89.21 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4389a485_0000f424 11/27/2005 7:20 AM 15.03 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_438a27a4_00029f63 11/27/2005 4:39 PM 235 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_438a67e6_0001e848 11/27/2005 9:13 PM 10.31 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_438f56f9_00090f56 12/1/2005 3:03 PM 563 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_43902e00_000d1cef 12/2/2005 6:20 AM 28.69 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_43906336_0004c4b4 12/2/2005 10:07 AM 550 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002350_4391155e_00044aa2 12/2/2005 10:47 PM 11.73 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_4388a6f3_00007a12 11/26/2005 1:18 PM 1.13 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_4388e42a_000d59f8 11/26/2005 5:39 PM 25.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_43899e35_00090f56 11/27/2005 6:53 AM 169.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_4389b5f5_0009c671 11/27/2005 8:34 AM 35.53 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_438a7338_00090f56 11/27/2005 10:02 PM 1.29 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_438f5aed_0001ab3f 12/1/2005 3:23 PM 1.41 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000023c9_43906691_0006ea05 12/2/2005 10:21 AM 10.16 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000249e_4388a733_00003d09 11/26/2005 1:19 PM 454 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000249e_438af670_00090f56 11/28/2005 7:22 AM 79.75 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000249e_438f9701_00066ff3 12/1/2005 7:36 PM 112.02 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000251f_4388af4d_000cdfe6 11/26/2005 1:54 PM 63.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000251f_438af9d7_0001312d 11/28/2005 7:36 AM 4.27 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000251f_438fb8bd_00081b32 12/1/2005 10:00 PM 53.68 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002528_438fbca1_00016e36 12/1/2005 10:16 PM 76.15 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_4388a764_000501bd 11/26/2005 1:20 PM 232 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_438908f9_000aba95 11/26/2005 8:16 PM 15.35 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_438af794_0009c671 11/28/2005 7:27 AM 34.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000252a_438fb75e_000e4e1c 12/1/2005 9:54 PM 3.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_4388a6b9_000f0537 11/27/2005 4:39 PM 6.05 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_4388dc19_00039387 11/26/2005 5:05 PM 28.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43892a9e_000b71b0 11/26/2005 10:40 PM 61.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_438a279d_0007de29 11/27/2005 4:39 PM 235 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_438a674b_000501bd 11/27/2005 9:11 PM 18.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_438f566a_000ec82e 12/1/2005 3:00 PM 345 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43902d67_00089544 12/2/2005 6:17 AM 21.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43906061_000e8b25 12/2/2005 9:55 AM 4.55 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000260d_43911519_000a7d8c 12/2/2005 10:46 PM 36.20 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_4388a713_000af79e 11/26/2005 1:18 PM 1.42 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_43899f27_000d9701 11/27/2005 6:57 AM 169.76 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_438af1ed_00007a12 11/28/2005 7:02 AM 13.52 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_438f5e20_000501bd 12/1/2005 3:36 PM 2.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000261e_43907399_00090f56 12/2/2005 11:17 AM 47 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000263d_438fbb2e_0004c4b4 12/1/2005 10:10 PM 5.68 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002668_438fbc58_00044aa2 12/1/2005 10:15 PM 57.86 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_4388a6b1_000dd40a 11/26/2005 1:17 PM 510 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_4388dae4_000af79e 11/26/2005 5:00 PM 119.70 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438928f5_000632ea 11/26/2005 10:33 PM 442 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_4389a378_000cdfe6 11/27/2005 7:15 AM 47.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438a278e_000501bd 11/27/2005 4:39 PM 468 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438a660c_0007270e 11/27/2005 9:06 PM 102.46 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_438f55de_00022551 12/1/2005 2:58 PM 5.83 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_43902c57_0003567e 12/2/2005 6:13 AM 56.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_43905f6c_0001e848 12/2/2005 9:51 AM 22.85 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026a6_439113cf_0001312d 12/2/2005 10:41 PM 1.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026b1_438fc74f_000a037a 12/1/2005 11:02 PM 3.08 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_4388a6d7_00094c5f 11/26/2005 1:17 PM 1.22 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_4388ddbc_0000b71b 11/26/2005 5:12 PM 100.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_43892dc2_000dd40a 11/26/2005 10:53 PM 42.99 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_4389b31f_00000000 11/27/2005 8:22 AM 373 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_438a7126_000e8b25 11/27/2005 9:53 PM 1.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_438f5956_0006ea05 12/1/2005 3:16 PM 2.11 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026ca_439065d3_000ca2dd 12/2/2005 10:18 AM 4 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4388a6a7_0006ea05 11/26/2005 1:17 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4388b0f2_000d1cef 11/26/2005 2:01 PM 58.51 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_43890dc6_0008d24d 11/26/2005 8:37 PM 75.84 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4389a16e_000c65d4 11/27/2005 7:07 AM 9.07 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4389f405_000aba95 11/27/2005 12:59 PM 8.33 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_438a5aac_000ec82e 11/27/2005 8:17 PM 5.89 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_438f182b_000aba95 12/1/2005 10:35 AM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4390288a_000a037a 12/2/2005 5:57 AM 3.57 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_43905cfc_000a7d8c 12/2/2005 9:41 AM 32.78 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000026e9_4391119b_0007de29 12/2/2005 10:31 PM 41.70 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002725_438fbadd_0002625a 12/1/2005 10:09 PM 78.83 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000027da_438fc767_000aba95 12/1/2005 11:02 PM 5.37 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000282d_438fbbf6_00000000 12/1/2005 10:13 PM 16.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_4388a732_000501bd 11/26/2005 1:19 PM 355 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_4388f159_000e4e1c 11/26/2005 6:35 PM 495 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_438af664_00003d09 11/28/2005 7:21 AM 114.56 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_438f8ce2_0000f424 12/1/2005 6:53 PM 38.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002833_43907e52_000a4083 12/2/2005 12:03 PM 313.32 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002852_438fbab9_0002625a 12/1/2005 10:08 PM 55.66 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_4388a70c_00000000 11/26/2005 1:18 PM 323 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_4388f0f8_000dd40a 11/26/2005 6:34 PM 30.30 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_43899eee_0007a120 11/27/2005 6:56 AM 4.90 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_438af0f0_00089544 11/28/2005 6:58 AM 13.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_438f5db5_000cdfe6 12/1/2005 3:31 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000288f_43907395_000d9701 12/2/2005 11:17 AM 105.61 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000028e2_438fc641_0003d090 12/1/2005 10:58 PM 48.18 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\0000293b_438fbc9a_000e8b25 12/1/2005 10:16 PM 13.48 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002959_438fbb96_00089544 12/1/2005 10:12 PM 15.24 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\000029d8_438fbaf6_00031975 12/1/2005 10:09 PM 1.14 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002a38_438fbdd4_000e1113 12/1/2005 10:21 PM 27.09 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b00_4388a7d6_00039387 11/26/2005 1:22 PM 896 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b00_438af81a_000487ab 11/28/2005 7:29 AM 72.79 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b00_438fb7dd_00016e36 12/1/2005 9:56 PM 51.28 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b0c_4388a733_00090f56 11/26/2005 1:19 PM 1.17 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b0c_4388f179_00053ec6 11/26/2005 6:36 PM 7 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002b0c_438f9708_000a037a 12/1/2005 7:36 PM 999 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002ba5_438fc637_00029f63 12/1/2005 10:57 PM 55.12 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002c3b_4388a6ce_0005f5e1 11/26/2005 1:17 PM 510 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00002c3b_4388dcb8_000c65d4 11/26/2005 5:07 PM 148 bytes Hidden from Win
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

Unread postby floete » December 6th, 2005, 11:56 am

i have no trouble booting into safe mode.

*however*, today, after booting into safe mode, i went to run, typed regedit and got the following response:

"windows cannot find regedit"

uh oh!

now what?
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

Unread postby Kimberly » December 6th, 2005, 12:30 pm

Hello floete,

My excuses to both of you for Hijacking this topic.

The RootkitRevealer log is cut of again ... :(

Just copy/paste the first part of the log, scoll through the report and find the last line contains the same folder name. - C:\Program Files\Newnvu\Cache in your log. Copy/Paste the remaining lines of the log.

C:\Program Files\Newnvu\Cache 12/2/2005 11:12 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu\Cache\00000029_4388a551_000e1113 12/2/2005 11:10 PM 34.62 KB Hidden from Windows API.


Your post will thus look similar to this after leaving out the C:\Program Files\Newnvu\Cache Folder:

HKLM\SOFTWARE\C1iesAC9ZXtm 12/2/2005 11:03 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDRMGMT 11/25/2005 12:55 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\Cdrmgmt 12/2/2005 11:08 PM 0 bytes Hidden from Windows API.
C:\Program Files\Newnvu 12/2/2005 5:50 AM 0 bytes Hidden from Windows API.
<leave out the C:\Program Files\Newnvu\Cache lines>
<insert the end of the rootkit revealer log here>

*however*, today, after booting into safe mode, i went to run, typed regedit and got the following response:

"windows cannot find regedit"


Did you leave out the quotes from the instructions ?
Start > run > type regedit (without quotes) and click OK (from Safe Mode of course)

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby floete » December 6th, 2005, 5:59 pm

1764

well i went and checked and the entire len gth of the file is 1,764 lines. that's right: 1764. do you still want em all? if so, that's fine: i'll break them up and send them the best i can.

yes, i'm sutre i typed regedit corre
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

Unread postby amateur » December 6th, 2005, 6:55 pm

1764

well i went and checked and the entire len gth of the file is 1,764 lines. that's right: 1764. do you still want em all? if so, that's fine: i'll break them up and send them the best i can.


Thanks floete, no need to post the 1764 lines. Just locate the last line that contains C:\Program Files\Newnvu\.... and post the rest of the Rootkit Revealer log from that line on. This means all the lines after the last repetitive line of "C:\Program Files\Newnvu or C:\Program Files\Newnvu\Cache" , not the ones before which we already have.

Thank you.
User avatar
amateur
MRU Master
MRU Master
 
Posts: 2545
Joined: September 25th, 2005, 1:13 pm
Location: RI, USA

Unread postby floete » December 7th, 2005, 5:48 pm

oh okay, here it is with a few last nvu's as well:

C:\Program Files\Newnvu\Cache\dns 12/2/2005 11:29 PM 69.91 KB Hidden from Windows API.
C:\Program Files\Newnvu\Cache\index 12/2/2005 11:12 PM 264.98 KB Hidden from Windows API.
C:\Program Files\Newnvu\data.bin 11/25/2005 12:56 PM 114.94 KB Hidden from Windows API.
C:\Program Files\Newnvu\rectapi.exe 11/27/2005 8:16 PM 912.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\txfsidle.exe 11/25/2005 12:56 PM 164.00 KB Hidden from Windows API.
C:\Program Files\Newnvu\WinGenerics.dll 11/25/2005 12:56 PM 576.00 KB Hidden from Windows API.
C:\WINDOWS\system32\drivers\mnmsmwdm.sys 11/25/2005 12:55 PM 12.00 KB Hidden from Windows API.
C:\WINDOWS\system32\gcmtus40.exe 12/1/2005 7:02 AM 488.00 KB Hidden from Windows API.
floete
Regular Member
 
Posts: 39
Joined: November 15th, 2005, 9:44 am

Unread postby amateur » December 7th, 2005, 7:02 pm

Hi Floete,

I am glad you were able to get us the final section of the log. Thank you. :D
Please copy/paste the following text inside the quote box into a new Notepad document. very important that it's Notepad, not wordpad.
@Echo off
cd %systemdrive%\
echo Removing service... > %systemdrive%\fixme.log
echo REGEDIT4 >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrmgmt] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDRMGMT] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrmgmt] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDRMGMT] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Cdrmgmt] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CDRMGMT] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Cdrmgmt] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDRMGMT] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Cdrmgmt] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_CDRMGMT] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\Cdrmgmt] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Enum\Root\LEGACY_CDRMGMT] >> fixme.reg
echo. >> fixme.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Option] >> fixme.reg
echo "OptionValue"=- >> fixme.reg
echo. >> fixme.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Option] >> fixme.reg
echo "OptionValue"=- >> fixme.reg
echo. >> fixme.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Option] >> fixme.reg
echo "OptionValue"=- >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\Software\Aprps] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\Software\Apropos] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_CURRENT_USER\Software\C1iesAC9ZXtm] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_USERS\S-1-5-21-2159004305-1186145291-2834281119-1006\Software\C1iesAC9ZXtm] >> fixme.reg
echo. >> fixme.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01A47E8F-9F5C-47DE-A69B-F03A49D4768A}] >> fixme.reg
echo. >> fixme.reg

reg import fixme.reg
echo Regfix imported... >> %systemdrive%\fixme.log
del fixme.reg

echo Deleting files... >> %systemdrive%\fixme.log
attrib -r -s -h C:\WINDOWS\system32\drivers\mnmsmwdm.sys
if exist C:\WINDOWS\system32\drivers\mnmsmwdm.sys del /q C:\WINDOWS\system32\drivers\mnmsmwdm.sys
if exist C:\WINDOWS\system32\drivers\mnmsmwdm.sys echo Deletion of file C:\WINDOWS\system32\drivers\mnmsmwdm.sys failed! >> %systemdrive%\fixme.log
if not exist C:\WINDOWS\system32\drivers\mnmsmwdm.sys echo Deletion of file C:\WINDOWS\system32\drivers\mnmsmwdm.sys succeeded! >> %systemdrive%\fixme.log

attrib -r -s -h C:\WINDOWS\system32\gcmtus40.exe
if exist C:\WINDOWS\system32\gcmtus40.exe del /q C:\WINDOWS\system32\gcmtus40.exe
if exist C:\WINDOWS\system32\gcmtus40.exe echo Deletion of file C:\WINDOWS\system32\gcmtus40.exe failed! >> %systemdrive%\fixme.log
if not exist C:\WINDOWS\system32\gcmtus40.exe echo Deletion of file C:\WINDOWS\system32\gcmtus40.exe succeeded! >> %systemdrive%\fixme.log

rmdir /q /s "C:\Program Files\Newnvu"
if exist C:\Program Files\Newnvu echo Deletion of folder C:\Program Files\Newnvu failed! >> %systemdrive%\fixme.log
if not exist C:\Program Files\Newnvu echo Deletion of folder C:\Program Files\Newnvu succeeded! >> %systemdrive%\fixme.log

attrib -r -s -h C:\WINDOWS\p1J7N
if exist C:\WINDOWS\p1J7N del /q C:\WINDOWS\p1J7N
if exist C:\WINDOWS\p1J7N echo Deletion of file C:\WINDOWS\p1J7N failed! >> %systemdrive%\fixme.log
if not exist C:\WINDOWS\p1J7N echo Deletion of file C:\WINDOWS\p1J7N succeeded! >> %systemdrive%\fixme.log

if exist %systemdrive%\regkey.txt del /q %systemdrive%\regkey.txt
if exist %systemdrive%\rk1.txt del /q %systemdrive%\rk1.txt
if exist %systemdrive%\rk2.txt del /q %systemdrive%\rk2.txt
if exist %systemdrive%\rk3.txt del /q %systemdrive%\rk3.txt

pause

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrmgmt>nul
IF ERRORLEVEL 0 echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrmgmt is present >> %systemdrive%\fixme.log
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDRMGMT>nul
IF ERRORLEVEL 0 echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDRMGMT is present >> %systemdrive%\fixme.log
reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrmgmt>nul
IF ERRORLEVEL 0 echo HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrmgmt is present >> %systemdrive%\fixme.log
reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDRMGMT>nul
IF ERRORLEVEL 0 echo HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDRMGMT is present >> %systemdrive%\fixme.log
reg query HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm>nul
IF ERRORLEVEL 0 echo HKEY_LOCAL_MACHINE\SOFTWARE\C1iesAC9ZXtm is present >> %systemdrive%\fixme.log

echo Finished!
echo Please restart your computer in Normal Mode.
echo and post the contents of fixme.log along with a new Rootkit Revealer log.
echo.

pause
exit


Save it to your desktop as cleanme.bat. Save it as:
File Type: All Files (not as a text document or it wont work).
Name: cleanme.bat
______________________________

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
______________________________

Double click cleanme.bat, let it do his job and reboot in Normal Mode.
-------------------------------------------------

Run HijackThis again. Close all other windows except HijackThis and place a checkmark against the following entry:

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-its:mhtml:file://c:\nosunel.mht!http://daemonlinks.net/script/lc.chm::/bridge-c46.cab

Click "Fix checked".

Run RootkitRevealer again please and save the log.

Post the C:\fixme.log along with the RootkitRevealer log and a New HijackThis log.
User avatar
amateur
MRU Master
MRU Master
 
Posts: 2545
Joined: September 25th, 2005, 1:13 pm
Location: RI, USA
Advertisement
Register to Remove

PreviousNext

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 31 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware