Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Now for my girlfriend's computer...

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Now for my girlfriend's computer...

Unread postby cawitt » October 20th, 2005, 11:37 pm

Kimberly did a kick-butt job on my work computer (thanks again, Kim)! Now, let's see if you guys can tackle my girlfriend's system...

Her computer runs really slowly, even though it should be a fast system. I can tell there's still some ad/spyware still on it, even though I ran the latest Ad-Aware and Spybot on it. Random pop-up ads come up, even when your site is the only one I have open (one just popped up just now in fact!). It even blue-screens pretty frequently (she's running XP). The error that comes up on the BSOD is IRQL_NOT_LESS_OR_EQUAL. But that may be a separate problem.

Anyway, here's her HJT log:


Logfile of HijackThis v1.99.1
Scan saved at 11:29:23 PM, on 10/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/accounts/Service ... %3Dl&hl=en
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKCU\..\Run: [dpwsockx] C:\WINDOWS\System32\dpwsockx.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {AEF76437-F960-4EBC-97EA-7BBB4230CF38} (OcarptMain Class) - https://oca.microsoft.com/en/secure/ocarpt.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.compani ... 3_16_0.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: p2pgraph - Unknown owner - C:\WINDOWS\system32\p2pgraph.exe (file missing)


Thanks for taking a look!

Chris
cawitt
Regular Member
 
Posts: 27
Joined: October 17th, 2005, 10:57 pm
Advertisement
Register to Remove

Unread postby Kimberly » October 21st, 2005, 1:07 am

Hello Chris,

Having more trouble I see ... :(

Ok, let's try to see what's up with your girlfriends PC. She's got winfixer (prolly the popups you get) but I'm not really worried about by that. I see two files and I would like to know what they exactly are. One of them may be missing, maybe not. IRQL_NOT_LESS_OR_EQUAL could be related to the O23 service I want you to check, or something else. Hard to know at this stage, but we'll try to find out later.

I would like / need some additional information before I start to work on your log.

Make sure that you can see hidden files.
  1. Click Start.
  2. Click My Computer.
  3. Select the Tools menu and click Folder Options.
  4. Select the View Tab.
  5. Under the Hidden files and folders heading select Show hidden files and folders.
  6. Uncheck the Hide protected operating system files (recommended) option.
  7. Click Yes to confirm.
  8. Uncheck the Hide file extensions for known file types.
  9. Click OK.
______________________________

Locate the following files with Windows Explorer, upload them to Jotti's scan and copy/paste the info it returns. It is possible that the second file has been deleted, HijackThis is not always accurate on missing files with the O23 entries.

http://virusscan.jotti.org/

C:\WINDOWS\System32\dpwsockx.exe

C:\WINDOWS\system32\p2pgraph.exe


If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Could you also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc ... Thanks.
______________________________

Please download the Registry Search Tool from here:
http://www.billsway.com/vbspage/
It's about half way the page, click on the arrow to expand and have access to the download.

Unzip it to a convienant location such as your Desktop. Make sure that your Antivirus / OS allows the use of the .vbs scripts. If prompted, make sure to allow the script.

Double click regsearch.vbs
Copy / Paste the following line into the Search Box:

p2pgraph

then hit Ok

It may take a while to run. It will tell you when it's done and offer you to look at the file.
Say Yes and when it opens copy/paste the content in your reply.
______________________________

Run HijackThis, click on Open the Misc Tools Section, click on Open Uninstall Manager. Click on Save List and save uninstall_list.txt to your Desktop. Open this file in Notepad and copy/past the content in your reply.
Click back (the one located at the right side of the save list button)
Put a checkmark in List also minor sections and List empty sections. Click on Generate StartupList log, anwser Yes and copy/past the content in your reply.
______________________________

I need some :sleepy2: now, I'll check back later.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby cawitt » October 23rd, 2005, 8:47 pm

So, we meet again! Hey, if you can help out here half as well as you did with my work PC, that'd be great!

C:\WINDOWS\System32\dpwsockx.exe

C:\WINDOWS\system32\p2pgraph.exe

These two files were not there. I do remember deleting the p2pgraph.exe file, after one of the online scanners found it to be corrupt. (This was right before I posted here.) There are, however, dll versions of these files (instead of exe), which I did scan, but they both came up clean. Both of them appear to be from Microsoft Corporation.


Here are the results from the registry search:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "p2pgraph" 10/23/2005 8:21:51 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_P2PGRAPH]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_P2PGRAPH\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_P2PGRAPH\0000]
"Service"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_P2PGRAPH\0000]
"DeviceDesc"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pgraph]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pgraph]
"DisplayName"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pgraph]
"Description"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pgraph\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pgraph\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pgraph\Enum]
"0"="Root\\LEGACY_P2PGRAPH\\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_P2PGRAPH]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_P2PGRAPH\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_P2PGRAPH\0000]
"Service"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_P2PGRAPH\0000]
"DeviceDesc"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\p2pgraph]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\p2pgraph]
"DisplayName"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\p2pgraph]
"Description"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\p2pgraph\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_P2PGRAPH]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_P2PGRAPH\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_P2PGRAPH\0000]
"Service"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_P2PGRAPH\0000]
"DeviceDesc"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pgraph]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pgraph]
"DisplayName"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pgraph]
"Description"="p2pgraph"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pgraph\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pgraph\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pgraph\Enum]
"0"="Root\\LEGACY_P2PGRAPH\\0000"

[HKEY_USERS\S-1-5-21-2166338481-2511679056-2105919262-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"e"="C:\\WINDOWS\\SYSTEM32\\p2pgraph.dll"

[HKEY_USERS\S-1-5-21-2166338481-2511679056-2105919262-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll]
"b"="C:\\WINDOWS\\SYSTEM32\\p2pgraph.dll"


Here's the uninstall list:

Ad-Aware SE Personal
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Download Manager 1.2 (Remove Only)
Adobe Photoshop Album 2.0 Starter Edition
Adobe Reader 7.0
a-squared Free 1.6
Broadcom Management Programs
Canon Camera Support Core Library
Canon Camera Window DS for ZoomBrowser EX
Canon Camera Window DVC for ZoomBrowser EX
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon ZoomBrowser EX
Compton's Interactive Bible NIV
Dell Digital Jukebox Driver
Dell Media Experience
Dell Solution Center
Dell Support 5.0.0 (734)
DS21Patch
EarthLink Setup Files
Ebates Moe Money Maker
HijackThis 1.99.1
Intel(R) Extreme Graphics Driver
Internet Explorer Default Page
iPod for Windows 2005-06-26
iPod Updater 2004-11-15
iTunes
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2
Learn2 Player (Uninstall Only)
McAfee SecurityCenter
McAfee VirusScan
Microsoft .NET Framework 1.1
Microsoft Data Access Components KB870669
Microsoft Encarta Encyclopedia Standard 2004
Microsoft Money 2004
Microsoft Money 2004 System Pack
ML-1430 Series
MUSICMATCH® Jukebox
QuickTime
RealPlayer Basic
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Shockwave
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Spybot - Search & Destroy 1.4
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WordPerfect Office 11


And finally, the startup list:

StartupList report, 10/23/2005, 8:33:01 PM
StartupList version: 1.52.2
Started from : C:\Program Files\HijackThis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\system32\notepad.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Susan Siu\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\Userinit.exe

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

IgfxTray = C:\WINDOWS\System32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
dla = C:\WINDOWS\system32\dla\tfswctrl.exe
VSOCheckTask = "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MCUpdateExe = c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
VirusScan Online = C:\Program Files\McAfee.com\VSO\mcvsshld.exe
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
OASClnt = C:\Program Files\McAfee.com\VSO\oasclnt.exe
PCMService = "C:\Program Files\Dell\Media Experience\PCMService.exe"
McRegWiz = c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Sonic RecordNow! =
dpwsockx = C:\WINDOWS\System32\dpwsockx.exe
DellSupport = "C:\Program Files\Dell Support\DSAgnt.exe" /startup
196_150_ni = C:\WINDOWS\System32\196_150_ni.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\INF\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\ssmyst.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - (no file) - {549B5CA7-4A86-11D7-A4DF-000874180BB3}
(no name) - C:\WINDOWS\system32\dla\tfswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890}
(no name) - (no file) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Download Program Files:

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/ ... mv9VCM.CAB

[McAfee.com Operating System Class]
InProcServer32 = C:\WINDOWS\system32\mcinsctl.dll
CODEBASE = http://download.mcafee.com/molbin/share ... insctl.cab

[Java Plug-in 1.4.2]
InProcServer32 = C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
CODEBASE = http://java.sun.com/products/plugin/aut ... s-i586.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://acs.pandasoftware.com/activescan ... asinst.cab

[OcarptMain Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\OCARPT.DLL
CODEBASE = https://oca.microsoft.com/en/secure/ocarpt.CAB

[DwnldGroupMgr Class]
InProcServer32 = C:\WINDOWS\system32\McGDMgr.dll
CODEBASE = http://download.mcafee.com/molbin/share ... cgdmgr.cab

[Java Plug-in 1.4.2]
InProcServer32 = C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
CODEBASE = http://java.sun.com/products/plugin/aut ... s-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shoc ... wflash.cab

[{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
CODEBASE = http://us.dl1.yimg.com/download.compani ... 3_16_0.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

abp480n5: \SystemRoot\System32\DRIVERS\ABP480N5.SYS (disabled)
Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
adpu160m: \SystemRoot\System32\DRIVERS\adpu160m.sys (disabled)
aeaudio: system32\drivers\aeaudio.sys (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: \SystemRoot\System32\DRIVERS\agp440.sys (disabled)
Compaq AGP Bus Filter: \SystemRoot\System32\DRIVERS\agpCPQ.sys (disabled)
Aha154x: \SystemRoot\System32\DRIVERS\aha154x.sys (disabled)
aic78u2: \SystemRoot\System32\DRIVERS\aic78u2.sys (disabled)
aic78xx: \SystemRoot\System32\DRIVERS\aic78xx.sys (disabled)
Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
AliIde: \SystemRoot\System32\DRIVERS\aliide.sys (disabled)
ALI AGP Bus Filter: \SystemRoot\System32\DRIVERS\alim1541.sys (disabled)
AMD AGP Bus Filter Driver: \SystemRoot\System32\DRIVERS\amdagp.sys (disabled)
amsint: \SystemRoot\System32\DRIVERS\amsint.sys (disabled)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
asc: \SystemRoot\System32\DRIVERS\asc.sys (disabled)
asc3350p: \SystemRoot\System32\DRIVERS\asc3350p.sys (disabled)
asc3550: \SystemRoot\System32\DRIVERS\asc3550.sys (disabled)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
Broadcom 440x 10/100 Integrated Controller XP Driver: System32\DRIVERS\bcm4sbxp.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
cbidf: \SystemRoot\System32\DRIVERS\cbidf2k.sys (disabled)
cd20xrnt: \SystemRoot\System32\DRIVERS\cd20xrnt.sys (disabled)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
CmdIde: \SystemRoot\System32\DRIVERS\cmdide.sys (disabled)
COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cpqarray: \SystemRoot\System32\DRIVERS\cpqarray.sys (disabled)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
dac2w2k: \SystemRoot\System32\DRIVERS\dac2w2k.sys (disabled)
dac960nt: \SystemRoot\System32\DRIVERS\dac960nt.sys (disabled)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
dpti2o: \SystemRoot\System32\DRIVERS\dpti2o.sys (disabled)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
drvmcdb: system32\drivers\drvmcdb.sys (system)
drvnddm: system32\drivers\drvnddm.sys (autostart)
3Com EtherLink XL 90XB/C Adapter Driver: System32\DRIVERS\el90xbc5.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
GEAR CDRom Filter: SYSTEM32\DRIVERS\GEARAspiWDM.sys (manual start)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Human Interface Device Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
hpn: \SystemRoot\System32\DRIVERS\hpn.sys (disabled)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i2omp: \SystemRoot\System32\DRIVERS\i2omp.sys (disabled)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
i81x: System32\DRIVERS\i81xnt5.sys (manual start)
iAimFP0: System32\DRIVERS\wADV01nt.sys (manual start)
iAimFP1: System32\DRIVERS\wADV02NT.sys (manual start)
iAimFP2: System32\DRIVERS\wADV05NT.sys (manual start)
iAimFP3: System32\DRIVERS\wSiINTxx.sys (manual start)
iAimFP4: System32\DRIVERS\wVchNTxx.sys (manual start)
iAimTV0: System32\DRIVERS\wATV01nt.sys (manual start)
iAimTV1: System32\DRIVERS\wATV02NT.sys (manual start)
iAimTV2: System32\DRIVERS\wATV03nt.sys (manual start)
iAimTV3: System32\DRIVERS\wATV04nt.sys (manual start)
iAimTV4: System32\DRIVERS\wCh7xxNT.sys (manual start)
ialm: System32\DRIVERS\ialmnt5.sys (manual start)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (manual start)
ini910u: \SystemRoot\System32\DRIVERS\ini910u.sys (disabled)
IntelIde: \SystemRoot\System32\DRIVERS\intelide.sys (disabled)
Intel Processor Driver: System32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
McAfee WSC Integration: c:\program files\mcafee.com\agent\mcdetect.exe (autostart)
McAfee.com McShield: c:\PROGRA~1\mcafee.com\vso\mcshield.exe (autostart)
McAfee Task Scheduler: c:\PROGRA~1\mcafee.com\agent\mctskshd.exe (autostart)
McAfee SecurityCenter Update Manager: C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (manual start)
Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
mraid35x: \SystemRoot\System32\DRIVERS\mraid35x.sys (disabled)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
NaiAvFilter1: system32\drivers\naiavf5x.sys (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
D-Link Air Wireless Adapter(RTL) NT Driver: System32\DRIVERS\NETR33X.SYS (manual start)
Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: System32\DRIVERS\nv4_mini.sys (manual start)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
OMCI WDM Device Driver: System32\DRIVERS\omci.sys (system)
p2pgraph: C:\WINDOWS\system32\p2pgraph.exe (autostart)
Intel PentiumIII Processor Driver: System32\DRIVERS\p3.sys (system)
Parallel port driver: System32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
PCIIde: System32\DRIVERS\pciide.sys (system)
perc2: \SystemRoot\System32\DRIVERS\perc2.sys (disabled)
perc2hib: \SystemRoot\System32\DRIVERS\perc2hib.sys (disabled)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\DRIVERS\PxHelp20.sys (system)
ql1080: \SystemRoot\System32\DRIVERS\ql1080.sys (disabled)
Ql10wnt: \SystemRoot\System32\DRIVERS\ql10wnt.sys (disabled)
ql12160: \SystemRoot\System32\DRIVERS\ql12160.sys (disabled)
ql1240: \SystemRoot\System32\DRIVERS\ql1240.sys (disabled)
ql1280: \SystemRoot\System32\DRIVERS\ql1280.sys (disabled)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: System32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SIS AGP Bus Filter: \SystemRoot\System32\DRIVERS\sisagp.sys (disabled)
smwdm: system32\drivers\smwdm.sys (manual start)
Sparrow: \SystemRoot\System32\DRIVERS\sparrow.sys (disabled)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
sscdbhk5: system32\drivers\sscdbhk5.sys (system)
SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
ssrtln: system32\drivers\ssrtln.sys (system)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{F79A1568-D6C5-4C69-A086-936CF52DBBE3} (manual start)
symc810: \SystemRoot\System32\DRIVERS\symc810.sys (disabled)
symc8xx: \SystemRoot\System32\DRIVERS\symc8xx.sys (disabled)
sym_hi: \SystemRoot\System32\DRIVERS\sym_hi.sys (disabled)
sym_u3: \SystemRoot\System32\DRIVERS\sym_u3.sys (disabled)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
tfsnboio: system32\dla\tfsnboio.sys (autostart)
tfsncofs: system32\dla\tfsncofs.sys (autostart)
tfsndrct: system32\dla\tfsndrct.sys (autostart)
tfsndres: system32\dla\tfsndres.sys (autostart)
tfsnifs: system32\dla\tfsnifs.sys (autostart)
tfsnopio: system32\dla\tfsnopio.sys (autostart)
tfsnpool: system32\dla\tfsnpool.sys (autostart)
tfsnudf: system32\dla\tfsnudf.sys (autostart)
tfsnudfa: system32\dla\tfsnudfa.sys (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TosIde: \SystemRoot\System32\DRIVERS\toside.sys (disabled)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
ultra: \SystemRoot\System32\DRIVERS\ultra.sys (disabled)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
SMC2662W V.2 EZ Connect Wireless USB Adapter: System32\DRIVERS\smcusbxp.sys (manual start)
USB2 Enabled Hub: System32\DRIVERS\usbhub.sys (manual start)
USB Scanner Driver: System32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
VIA AGP Bus Filter: \SystemRoot\System32\DRIVERS\viaagp.sys (disabled)
ViaIde: \SystemRoot\System32\DRIVERS\viaide.sys (disabled)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
WAN Miniport (ATW): System32\DRIVERS\wanatw4.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Intel(R) Graphics Platform (SoftBIOS) Driver: system32\drivers\ialmsbw.sys (manual start)
Intel(R) Graphics Chipset (KCH) Driver: system32\drivers\ialmkchw.sys (manual start)


--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 36,351 bytes
Report generated in 1.406 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


Thanks for taking a look!
cawitt
Regular Member
 
Posts: 27
Joined: October 17th, 2005, 10:57 pm

Unread postby Kimberly » October 24th, 2005, 1:10 am

Hello Chris,

Just for information, the dll version may remain, they are legitimate files from MS.

File Description: Peer-to-Peer Graphing Product Name: Microsoft® Windows® Operating System
Size (in bytes): 312,320 File Date: 8/4/2004 3:56:44 AM
File Function: DLL File Type: Application Extension
Original Filename: Internal Name: p2pgraph.dll
Legal Copyright: © Microsoft Corporation. All rights reserved. Legal Trademarks:
Product Version: 5.1.2600.2180 File Comments:
Scanned From OS Version: Microsoft Windows XP Scanned from Service Pack: Service Pack 2

File Description: Internet TCP/IP and IPX Connection For DirectPlay Product Name: Microsoft® Windows® Operating System
Size (in bytes): 57,344 File Date: 8/4/2004 3:56:42 AM
File Function: DLL File Type: Application Extension
Original Filename: Internal Name: dpwsockx.dll
Legal Copyright: © Microsoft Corporation. All rights reserved. Legal Trademarks:
Product Version: 5.03.2600.2180 File Comments:
Scanned From OS Version: Microsoft Windows XP Scanned from Service Pack: Service Pack 2

I still have to look up the rest of the logs and sort out those p2pgraph regkeys. I'll post back later on.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby Kimberly » October 24th, 2005, 12:14 pm

Hello Chris,

Let's try to fix the PC the best we can. :)
I can't find info on those 2 files I did ask to check at Jotti's, so I'm unable to tell what their purpose was. Winfixer can be a very stubborn thing and sometimes hard to remove that's why the list of scans is rather long but it should give good results in case something is lurking and show us about anything present on the PC.

We are going to remove the p2pgraph service, I can't give you a reg fix because you probably will have to change permissions on the LEGACY_P2PGRAPH keys in order to delete them, so it has to be done manually.

Click Start then Run
Type in regedit
Click Ok.

In left pane of registry editor, Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pgraph
If p2pgraph exists , right click on it and choose Delete from the menu.

Now navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_P2PGRAPH
If LEGACY_P2PGRAPH exists then right click on it and choose Delete from the menu.

If you have trouble deleting a key, click once on the key name to highlight it and click on the Permission menu option under Edit. Uncheck Allow inheritible permissions and press copy. Click on everyone and put a checkmark in full control, press apply and ok and attempt to delete the key again.

Repeat the above procedure for the following keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_P2PGRAPH

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pgraph

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_P2PGRAPH

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\p2pgraph
______________________________

Now, your girlfiriend has the Dell My Way Search Assistant on her PC. I always recommend removal, but some people like to use it so I'll post this as an option. If you don't remove the Dell My way, you will have to pay attention when using Ad-Aware, Ewido, Spybot S&D

http://www.theregister.co.uk/2005/07/15 ... ntroversy/
http://castlecops.com/a6162-The_Dell_an ... _Saga.html
http://castlecops.com/postitle114199-0-0-.html

Follow these steps to remove it if you want, otherwise skip to the Download / Update instructions just below.

I suppose you still have the Registry Search Tool on the PC because we need to find the installer package first.

Double click regsearch.vbs
Copy / Paste the following line into the Search Box:

LocalPackage

then hit Ok

It may take a while to run. It will tell you when it's done and offer you to look at the file.
Say Yes. When the Wordpad document opens with a list of .msi files, use the find feature of Wordpad to search for this numerical string which is the CLSID for MyWay installer : 7D449D87B79A4004BAA05BDA60389904

You should be able to locate an entry similar to this one within the search results (use the Wordpad search function and look
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7D449D87B79A4004BAA05BDA60389904\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\818b.msi"


You are interested in the numerical .msi file associated with the CLSID = 7D449D87B79A4004BAA05BDA60389904 which is the installer file for MyWay. Once you have this numerical file name (here the file is called 818b.msi), you may locate that file on your system by using WIndows Explorer to navigate to the C:\Windows\Installer directory. Your installer file name will probably be different.

(It is possible that there may be more than one installer file.) The installer file can be also be used to uninstall MyWay. Once the installer file is located WIndows Explorer, right-click the entry and select the uninstall option.

Note: In the event that Dell did change the CLSID, you can use regsearch.vbs to search the registry for 'my way' and 'myway' to identify this CLSID for the MyWay installer file. If you do that, you will be able to identify it in several entries. One of them should look like this:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7D449D87B79A4004BAA05BDA60389904\InstallProperties]
"Publisher"="MyWay.com"
______________________________

Download / Update instructions

Please download the trial version of Ewido Security Suite 3.5 from here:
http://www.ewido.net/en/download/
  • Install Ewido Security Suite.
  • When installing, under Additional Options uncheck Install background guard and Install scan via context menu.
  • When you run Ewido for the first time, you could get a warning "Database could not be found!". Click Ok.
  • The program will prompt you to update. Click the Ok button.
  • The program will now go to the main screen.
You will need to update Ewido to the latest definition files.
  • On the left-hand side of the main screen click the Update Button.
  • Click on Start.
The update will start and a progress bar will show the updates being installed.
Once finished updating, close Ewido.

If you are having problems with the updater, you can use this link to manually update ewido.
Ewido manual updates. Make sure to close Ewido before installing the update.
______________________________

If you already have the latest Ad-Aware SE 1.06 version, skip to Run Ad-Aware. Otherwise download Ad-Aware SE 1.06 from here and install it. Uncheck all the options before leaving the Install Wizard.

Run Ad-Aware and Click on the World Icon. Click the Connect button on the webupdate screen. If an update is available download it and install it. Click the Finish button to go back to the main screen.

Click on the Gear Icon (second from the left at the top of the window) to access the Configuration Window.

Click on the General Button on the left and select in green
  • Under Safety
    • Automatically save log-file
    • Automatically quarantine objects prior to removal
    • Safe Mode (always request confirmation)
  • Under Definitions
    • Prompt to udate outdated definitions - set to 7 days
Click on the Scanning Button of the left and select in green
  • Under Driver, Folders & Files
    • Scan Within Archives
  • Under Select drives & folders to scan
    • choose all hard drives
  • Under Memory & Registry
    • Scan Active Processes
    • Scan Registry
    • Deep Scan Registry
    • Scan my IE favorites for banned URL’s
    • Scan my Hosts file
Click on the Advanced Button on the left and select in green
  • Under Shell Integration
    • Move deleted files to Recycle Bin
  • Under Logfile Detail Level
    • Include addtional object information
    • DESELECT - Include negligible objects information (make it show a red X)
    • Include environment information
  • Under Alternate Data Streams
    • Don't log streams smaller than 0 bytes
    • Don't log ADS with the following names: CA_INOCULATEIT
Click the Tweak Button and select in green
  • Under the Scanning Engine (Click on the + sign to expand)
    • DESELECT Unload recognized processes & modules during scan (make it show a red X)
    • Scan registry for all users instead of current user only
  • Under the Cleaning Engine (Click on the + sign to expand)
    • Always try to unload modules before deletion
    • During Removal, unload Explorer and IE if necessary
    • Let Windows remove files in use at next reboot
  • Under the Log Files (Click on the + sign to expand)
    • Include basic Ad-aware SE settings in logfile
    • Include additional Ad-aware SE settings in logfile
    • Include reference summarry in log file
    • Include alternate data stream details in log file
Click on Proceed to save the settings and close the program.
______________________________

If not already installed, download and install the VX2 Cleaner 2.0 plugin from Lavasoft by following the instructions below.

Installing VX2 Cleaner 2.0
  1. Close Ad-Aware, if it is currently open.
  2. Download the VX2 Cleaner 2.0 Plug-in here.
  3. Instal by clicking on the vx2cleaner_inst.exe.
______________________________

Update Spybot - S&D before using it

Click on the Search for Updates button. If there are available updates, they will be listed. Click on the Download Updates button and Spybot - S&D will download the updates and install them.
Note: Use one of the Safer Networking servers to update due to checksum problems.
______________________________

Click on Start, Control Panel, click on Add/Remove Programs
Look through the installed programs for the following items and remove them if present:

Ebates Moe Money Maker

During the uninstall process, you might be presented with several prompts to guide you through uninstalling the product. Read these carefully to make sure you are actually choosing to uninstall rather than keep the software. If it wants to get an installer on Internet, deny it and move to the next step.
______________________________

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
______________________________

Run HijackThis, click on None of the above, just start the program, click on Scan. Put a check in the box on the left side of the following items if still present:
The blue entries represent Dell My Way, don't check them if you didn't remove the search assistant.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKCU\..\Run: [dpwsockx] C:\WINDOWS\System32\dpwsockx.exe
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O23 - Service: p2pgraph - Unknown owner - C:\WINDOWS\system32\p2pgraph.exe (file missing)


Close ALL windows and browsers except HijackThis and click Fix Checked
______________________________

Using Windows Explorer, Search and Delete these Folders if listed:

C:\Program Files\Ebates_MoeMoneyMaker

Using Windows Explorer, Search and Delete these Files if listed:

C:\WINDOWS\System32\dpwsockx.exe
C:\WINDOWS\System32\196_150_ni.exe
C:\WINDOWS\system32\p2pgraph.exe


Use the Start > Search function to find the following Files and Delete them if listed. Make sure that Local Disk (C) is listed in the dropdrown box - if not, click the arrow and select it.
Click All files and folders, and then click More advanced options.
  • Click to select the Search system folders and Search hidden files and folders check boxes.
  • Make sure that the Subfolders are checked too.
Type the name of the folder in the search box and click the Search button. Delete anything it finds if you did remove the Dell search assistant.

MyWay

If you get an error when deleting a file, right click on the file and check to see if the read only attribute is checked. If it is uncheck it and try again.
______________________________

Normally I instruct the user to clean up all the files with Ewido. We'll use a manual action on each files, especially if you didn't remove the My Way search assistant. Don't worry if you delete a legitimate file, Ewido keeps a backup of them and they are easy to restore. Clean up the rest.

Close ALL open Windows / Programs / Folders. Please start Ewido Security Suite, and run a full scan. Do not open any folder's or run programs while the scan is in progress.
  • Click on Scanner
  • Click on Settings
    • Under How to scan all boxes should be checked
    • Under Unwanted Software all boxes should be checked
    • Under What to scan select Scan every file
    • Click on Ok
  • Click on Complete System Scan to start the scan process.
  • NOTE: During some scans with ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action, otherwise select the clean action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.
  • Click Save Report button
  • Save the report to your Desktop
Close Ewido.
______________________________

Navigate to C:\Windows\Prefetch
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Windows\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Clean out your Temporary Internet files. Procede like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, click to select the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Reboot in Normal Mode, Start Ad-Aware SE
  • Click on Add-ons
  • Select the VX2 Cleaner plug-in and click Run Tool
  • If your computer isn’t infected, click Close.
    OR
  • If you computer is infected with VX2, a dialog box with text such as New VX2 variant found or VX2 variant 1 found will appear.
  • Press Clean and a dialog box with text The first phase completed. Please reboot and perform a Smart Scan will appear.
  • Reboot your computer
  • Run Ad-Aware and Click on the Scan Now Button
    • Choose Perform Full System Scan
    • DESELECT Search for negligible risk entries, as negligible risk entries (MRU's) are not considered to be a threat. (make it show a red X)
    Click Next to begin the scan. When the scan is completed, the Performing System Scan screen will change name to Scan Complete.

    Click the Next Button to get to the Scanning Results Window where more information about the objects detected during the scan is available. Click the Critical Objects Tab. In general all of the items listed will be bad. To fix all the bad critical objects, right click on one of them, click the Select All entry in the pop-up menu to mark all entries. Click Next and then OK in the dialog box to confirm the removal.
Repeat this until the VX2 Cleaner reports System clean. Press Close to exit.

Run Ad-Aware one more time and perform a Perform Full System Scan of your computer to make sure VX2 has been found and removed.

Watch out for Dell search assistant / Dell MyWay if you didn't remove it
______________________________

Run Spybot - S&D

Click the button Check for Problems
When Spybot is complete, it will be showing RED entries, BLACK entries and GREEN entries in the window.
Make sure that there is a check mark beside all of the RED entries ONLY.
Choose Fix Selected Problems and allow Spybot to fix the RED entries.

If it has trouble removing any spyware, you will get a message window, asking if it would be ok to run Spybot - S&D on the next reboot before any other applications start running. You should reply Yes to this. The next time you start Windows, Spybot will run automatically and fix any of the programs it could not fix previously.

At this point you will be presented with the list of found entries again, but now there will be large green checkmarks next to the items that Spybot - S&D was able to remove. The ones that are still checked but do not have the large green checkmark next to them will be fixed on the next reboot of windows.

Watch out for Dell search assistant / Dell MyWay if you didn't remove it
______________________________

Reboot in Normal Mode and run Panda's ActiveScan and perform a full system scan. I see that you have the ActiveX control already installed, Panda did modify their scans, make sure that you run the Active Scan and not the spyXposerscan
  • Once you are on the Panda site click the Scan your PC button.
  • A new window will open...click the big Check Now button.
  • Enter your Country.
  • Enter your State/Province.
  • Enter your e-mail address.
  • Select either Home User or Company.
  • Click the big Scan Now button.
  • Allow the ActiveX component to install and download the files required for the scan. This may take a couple of minutes.
  • Click on Local Disks to start the scan.
Upon scan completion, if anything malicious is detected, click See Report, then click Save Report and save it to your Desktop.
______________________________

Please do an online scan with Kaspersky Online Scanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
______________________________

I would like to see some reg keys, see if everything looks ok.

Download WinPFind.zip to your Desktop from
http://www.bleepingcomputer.com/files/winpfind.php
Extract it to your C:\ folder. This will create a folder called WinPFind in the C:\ folder.

Open the C:\WinPFind folder and double-click on WinPFind.exe.
Click on configure Scan Options.
Remove all the checkmarks under Folder Options on the left side by clicking the button Remove All, uncheck Run Addon's and click Apply.
Click on the Start Scan button and wait for it to finish.

Please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log file at C:\WinPFind\WinPFind.txt. Pleased copy that log to your next reply.
______________________________

We can as well totally clean up Dell My Way if you did remove it, perform the following:

Double click regsearch.vbs
Copy / Paste the following line into the Search Box:

myway

then hit Ok

It may take a while to run. It will tell you when it's done and offer you to look at the file.
Say Yes and when it opens copy/paste the content in your reply.

Please post the Ewido log, the Panda results, the Kaspersky results, WinPFind.txt, the small reglookup just above and a new Hijackthis log.
______________________________

If we want to try to resolve the BSOD, we need to find out the stop error associated to the IRQL_NOT_LESS_OR_EQUAL

Use one of the following ways to get into the Event Viewer.

1. Start, Rightclick on My Computer and select Manage then Event Viewer.
2. Control Panel -> Adminstrative Tools -> Event Viewer

Click on System in the left pane, look for Event 1001/1003, it should show info about the stop error. Double click to open them up and copy them by pressing the bottom of the three buttons (the one with the copy icon). Then Edit Paste it to a reply. Normally that should help to find the reason of the BSOD.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby cawitt » October 31st, 2005, 11:36 pm

Hey, Kim! Sorry it's taken so long to respond, but I've not had a lot of chances recently to get on my gf's computer. I've finally finished going through the process you recommended.

I tried to remove Dell MyWay, but couldn't find the CLSID. So I couldn't find the installer file. I also tried to search for 'my way' and 'myway' but didn't find an entry that indicated the install file. Here's what I found:

Code: Select all
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "LocalPackage" 10/24/2005 8:36:19 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0B79C053C7D38EE4AB9A00CB3B5D2472\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\1128e.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0BCD97B97DAAB654D87034C339F62AB4\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\d172.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0DEF1459F7230FD4B869FE75FE26F291\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc53.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\19F4AD9090A22324BAC8B67C0490D63E\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6005c.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1EF3A7EF67FADF44CB079068A81588A7\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\a7aed9.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1FFEDB53016A65940AD05154C3113659\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\d16c.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\20943A18B0D902942AC5C4CDD5413B82\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\d168.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\24306D8668679C548BBE04FE48D34006\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\4fc4e.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\29FE602138E29584CABC02843CBCD76A\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc59.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2C965B116FB40DE4D9714A729334BC42\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\3b0320.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3EBBB81236EF2BB4188A475375A548AF\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a9161.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4400144094196C548A602FFBC9CF7E26\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc75.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\541E46C8AB456D11191B00054026EB08\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc7c.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\55B09F453BEBD0F48820228822AF9512\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\4fc6d.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5D43537E39CC36C40927A5794352C547\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a917c.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5DB192822D29586428CDCC9A525CC3AC\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a919c.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7447A0000000000\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\2ec5af.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6C41D07AC2FFE8B46A34E747CE066741\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a9184.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\721000CCD5E5C1A409BCEEAACAE1A30C\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\d164.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7D38926880AFE3949ADEB687950E963D\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a916a.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7DC346D16DD47D114A0E00804781B03B\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc81.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\851C266542AC8224FBC695F6DA0A6828\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a9177.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\87F80874871FCD947B8051EF35B861FF\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\1849bc.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F841731866D117AB7000B0D410200\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc24.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8E54F9B4EC3E4B044936089A3B84D1FE\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\4fc36.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A0291F112A6524646B0EB3131AC22988\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\4fc29.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A7D67D1CBB3FAE747A64B5E1F2CFD12F\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a9166.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B0C37E607ED714F468B08507337BB59D\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9654db.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B3EFC2B955F768742AD0BB4294416F8D\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc71.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B758EE980798F9F4BA851A8C37CA273B\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc3e.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\BD614BED9AF46B24483DE1001803C0E9\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a91a4.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D57DE4CFC619C8A4BB76C3F6E6606DB2\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\4fc66.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D9C748B785766E545B89B38D4FE3EAE9\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a918c.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\DDE7F2BCF1D91C3409CFF425AE1E271A\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\4fc2e.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\E4E43F0A0F5286B4EAF8FEC051BCF1DE\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\9a9194.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F3A55D0999D149C47AE764CD410FFB80\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\4fc47.msi"


and

Code: Select all
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "myway" 10/24/2005 9:17:27 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.dell4me.com/myway"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"First Home Page"="http://www.dell4me.com/myway"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.dell4me.com/myway"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.dell4me.com/myway"

[HKEY_USERS\S-1-5-21-2166338481-2511679056-2105919262-1007\Software\Microsoft\Internet Connection Wizard]
"ShellNext"="http://www.dell4me.com/myway"

[HKEY_USERS\S-1-5-21-2166338481-2511679056-2105919262-1007\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.dell4me.com/myway"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
"First Home Page"="http://www.dell4me.com/myway"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.dell4me.com/myway"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.dell4me.com/myway"


So, I couldn't get it uninstalled, but I really would like to.


When I rebooted in Safe Mode, there were two accounts you could log into: Admin and my gf's. I thought, to be safe, I'd log in as Admin. So I did all the Safe Mode stuff as Admin. Later, I realized maybe I should have logged in as her and did it, since maybe some of the bad stuff only is under her account, but I didn't have time to go back and do it again. Does it matter?

One reason I was concerned was that only 2 of the 6 entries were there when I ran HJT (not counting the MyWay entries). I fixed the two that were there.

Here's the Ewido log:

Code: Select all
---------------------------------------------------------
 ewido security suite - Scan report
---------------------------------------------------------

 + Created on:			10:08:14 PM, 10/26/2005
 + Report-Checksum:		64510D22

 + Scan result:

	HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\unebmm350 -> Spyware.MoneyMaker : Cleaned with backup
	HKU\S-1-5-21-2166338481-2511679056-2105919262-500\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@ads.pointroll[1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@jcrew.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@msnportal.112.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@perf.overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@sales.liveperson[2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@server.iad.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
	C:\Documents and Settings\Susan Siu\Cookies\susan siu@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
	C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP277\A0030685.exe -> Spyware.eAcceleration : Cleaned with backup
	C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP277\A0030704.exe -> Spyware.eAcceleration : Cleaned with backup
	C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP277\A0030706.exe -> Spyware.eAcceleration : Cleaned with backup
	C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP277\A0030707.exe -> Spyware.eAcceleration : Cleaned with backup
	C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP277\A0030721.exe -> Spyware.eAcceleration : Cleaned with backup
	C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038013.exe -> Trojan.Downloader.reqlook : Cleaned with backup


::Report End


Panda came up clean.

Kaspersky found some stuff:

Code: Select all
-------------------------------------------------------------------------------
 KASPERSKY ON-LINE SCANNER REPORT
 Monday, October 31, 2005 20:46:22
 Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
 Kaspersky On-line Scanner version: 5.0.67.0
 Kaspersky Anti-Virus database last update:  1/11/2005
 Kaspersky Anti-Virus database records: 157559
-------------------------------------------------------------------------------

Scan Settings:
	Scan using the following antivirus database: extended
	Scan Archives: true
	Scan Mail Bases: true

Scan Target - My Computer:
	A:\
	C:\
	D:\

Scan Statistics:
	Total number of scanned objects: 46428
	Number of viruses found: 1
	Number of infected objects: 21
	Number of suspicious objects: 0
	Duration of the scan process: 2209 sec

Infected Object Name - Virus Name
C:\RECYCLER\S-1-5-21-2166338481-2511679056-2105919262-500\Dc134.exe	Infected: Trojan.Win32.Crypt.t
C:\RECYCLER\S-1-5-21-2166338481-2511679056-2105919262-500\Dc136.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP267\A0025514.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP267\A0026501.dll	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP280\A0032835.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP280\A0032836.dll	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP280\A0032838.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP280\A0032839.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP280\A0032840.dll	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP280\A0032841.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP281\A0032855.dll	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038002.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038003.dll	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038004.dll	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038006.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038007.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038008.dll	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038009.exe	Infected: Trojan.Win32.Crypt.t
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP285\A0038012.dll	Infected: Trojan.Win32.Crypt.t
C:\WINDOWS\SYSTEM32\bachserv.exe	Infected: Trojan.Win32.Crypt.t
C:\WINDOWS\SYSTEM32\defmtxdm.dll	Infected: Trojan.Win32.Crypt.t

Scan process completed.


Here's WinPFind.txt:

Code: Select all
WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP    Current Build: Service Pack 2    Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
	SV1	 = 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
	{750fdf0e-2a26-11d1-a3ea-080036587f03}	 = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
	{09799AFB-AD67-11d1-ABCD-00C04FC30936}	 = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
	{A470F8CF-A1E8-4f65-8335-227475AA5C46}	 = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
	Start Menu Pin	 = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022}
		 = c:\progra~1\mcafee.com\vso\mcvsshl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\a2ContMenu
	{AB77609F-2178-4E6F-9C4B-44AC179D937A}	 = C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022}
		 = c:\progra~1\mcafee.com\vso\mcvsshl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
	{A470F8CF-A1E8-4f65-8335-227475AA5C46}	 = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
	{750fdf0e-2a26-11d1-a3ea-080036587f03}	 = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\QuickFinderMenu
	{C0E10002-0028-0004-C0E1-C0E1C0E1C0E1}	 = c:\Program Files\WordPerfect Office 11\Programs\PFSE110.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
	{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}	 = ntshrui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
	 = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
	 = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
	 = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
	 = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
	 = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
	AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
	 = C:\PROGRA~1\SPYBOT~1\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}
	DriveLetterAccess = C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
	&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
	Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
	{BA52B914-B692-46c4-B683-905236F6F655}	 = McAfee VirusScan	: c:\progra~1\mcafee.com\vso\mcvsshl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
	MenuText	 = Sun Java Console	: C:\WINDOWS\System32\msjava.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
	ButtonText	 = Real.com	: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
	ButtonText	 = Messenger	: C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
	 = 
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
	File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
	Explorer Band = %SystemRoot%\System32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
	{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address	: %SystemRoot%\System32\browseui.dll
	{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links	: %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
	IgfxTray	C:\WINDOWS\System32\igfxtray.exe
	HotKeysCmds	C:\WINDOWS\System32\hkcmd.exe
	dla	C:\WINDOWS\system32\dla\tfswctrl.exe
	VSOCheckTask	"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
	MCAgentExe	c:\PROGRA~1\mcafee.com\agent\mcagent.exe
	MCUpdateExe	C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
	VirusScan Online	C:\Program Files\McAfee.com\VSO\mcvsshld.exe
	iTunesHelper	"C:\Program Files\iTunes\iTunesHelper.exe"
	OASClnt	C:\Program Files\McAfee.com\VSO\oasclnt.exe
	PCMService	"C:\Program Files\Dell\Media Experience\PCMService.exe"
	McRegWiz	c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
	Sonic RecordNow!	
	dpwsockx	C:\WINDOWS\System32\dpwsockx.exe
	196_150_ni	C:\WINDOWS\System32\196_150_ni.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EbatesMoeMoneyMaker0
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	EbatesMoeMoneyMaker0
	hkey	HKLM
	command	"C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
	inimapping	0
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	EbatesMoeMoneyMaker0
	hkey	HKLM
	command	"C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
	inimapping	0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mmtask
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	mmtask
	hkey	HKLM
	command	c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
	inimapping	0
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	mmtask
	hkey	HKLM
	command	c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
	inimapping	0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	qttask
	hkey	HKLM
	command	"C:\Program Files\QuickTime\qttask.exe" -atboottime
	inimapping	0
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	qttask
	hkey	HKLM
	command	"C:\Program Files\QuickTime\qttask.exe" -atboottime
	inimapping	0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RealTray
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	RealPlay
	hkey	HKLM
	command	C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
	inimapping	0
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	RealPlay
	hkey	HKLM
	command	C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
	inimapping	0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UpdateManager
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	sgtray
	hkey	HKLM
	command	"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
	inimapping	0
	key	SOFTWARE\Microsoft\Windows\CurrentVersion\Run
	item	sgtray
	hkey	HKLM
	command	"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
	inimapping	0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
	system.ini	0
	win.ini	0
	bootini	0
	services	0
	startup	2


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
	{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
	{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = 
	{0DF44EAA-FF21-4412-828E-260A8728E7F1} = 


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
	dontdisplaylastusername	0
	legalnoticecaption	
	legalnoticetext	
	shutdownwithoutlogon	1
	undockwithoutlogon	1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
	NoDriveTypeAutoRun	145


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
	PostBootReminder               	{7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
	CDBurn                         	{fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
	WebCheck                       	{E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
	SysTray                        	{35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
	UserInit	= C:\WINDOWS\system32\Userinit.exe
	Shell		= Explorer.exe
	System		= 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
	 = crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
	 = cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
	 = cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui
	 = igfxsrvc.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
	 = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
	 = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
	 = sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
	 = WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
	 = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
	 = wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
	Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
	AppInit_DLLs	


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1	- Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 10/31/2005 9:00:19 PM



Her computer is still running slowly, and still getting lots of BSODs. Here is log of the latest (there are many) of each 1001 and 1003 error:

The latest 1001:

Code: Select all
Event Type:	Information
Event Source:	Save Dump
Event Category:	None
Event ID:	1001
Date:		10/31/2005
Time:		7:44:04 PM
User:		N/A
Computer:	D26MB541
Description:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0xe26eec68, 0x000000ff, 0x00000000, 0x80563dba). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


The latest 1003:

Code: Select all
Event Type:	Error
Event Source:	System Error
Event Category:	(102)
Event ID:	1003
Date:		10/31/2005
Time:		8:02:28 PM
User:		N/A
Computer:	D26MB541
Description:
Error code 000000d1, parameter1 e2c30624, parameter2 000000ff, parameter3 00000000, parameter4 ffa78ff4.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 30 30 30 30 30 30 64    000000d
0020: 31 20 20 50 61 72 61 6d   1  Param
0028: 65 74 65 72 73 20 65 32   eters e2
0030: 63 33 30 36 32 34 2c 20   c30624, 
0038: 30 30 30 30 30 30 66 66   000000ff
0040: 2c 20 30 30 30 30 30 30   , 000000
0048: 30 30 2c 20 66 66 61 37   00, ffa7
0050: 38 66 66 34               8ff4    



One more thing: I don't know if it matters, but all of this was done over the course of the past week, in increments. Every time I get some done on it, I'd have to go, so I'd mark my place, then pick up when I came back. This was the 4th "session" I've had with her computer getting this done. In between, she has used the computer, and I don't know if it got more infections between sessions. So if I need to re-run any of this stuff, let me know.

Thanks again!

Chris
cawitt
Regular Member
 
Posts: 27
Joined: October 17th, 2005, 10:57 pm

Unread postby Kimberly » November 1st, 2005, 1:21 am

Hello Chris,

No worries. It's not easy to tell if something new did get in, the Kaspersky scan is very recent so I don't think you've got something really new lately, probably leftovers (some registry entries) from her account.

The Trojan.Win32.Crypt.t is rather recent, Sophos offers only protection since 24 October, Kaspersky since 19 October. It would be good to get rid of it rather fast, the trojan includes functionality to access the internet and communicate with a remote server via HTTP. It may download and run further software.

We will take care first of the entries in System Restore and the Recycle Bin so that it can't reinstall itself.

The scans shouldn't take too much time, you may run them from Normal Mode. For Dell My Way, there are two possibilities, they don't use an installer/uninstaller anymore (seems strange tho) or some entries got removed already. Fix the Dell entries in the Hijackthis log and set her a new homepage once they are gone. while you are fixing this, I'll check out the System Errors and post back if I can find more info about them. Note that they may be related to the presence of the trojan.

Turn off System Restore
  1. Click Start, right-click My Computer, and then click Properties.
  2. Click the System Restore tab.
  3. Select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
  4. Click Yes when you receive the prompt to the turn off System Restore.
Reboot your computer.

Turn System Restore back on
  1. Click Start, right-click My Computer, and then click Properties.
  2. Click the System Restore tab.
  3. Clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
A new restore point will be created automatically.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Update Ewido, Ad-Aware and Spybot (use the Safer Networking server atm)

Ewido, Ad-Aware, Spybot ... usually clean up all user accounts when we are talking about files and the HKEY_LOCAL_MACHINE registry keys. They don't clean up the HKEY_CURRENT_USER key from another account, only the one from the current account. So you will have to fix the entries you didn't see in the HijackThis log from her account. If you already did delete the files from the entries below, fix them in Normal Mode, otherwise boot into Safe Mode to fix them. The registry needs to be checked too.

O4 - HKCU\..\Run: [dpwsockx] C:\WINDOWS\System32\dpwsockx.exe
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
______________________________

Delete the following files

C:\WINDOWS\SYSTEM32\bachserv.exe
C:\WINDOWS\SYSTEM32\defmtxdm.dll

______________________________

Copy/paste the following text into a new Notepad document. Make sure that you have one blank line at the end of the document as shown in the quoted text.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EbatesMoeMoneyMaker0]


Save it to your desktop as Fixme.reg. Save it as :
File Type: All Files (not as a text document or it wont work).
Name: Fixme.reg

Locate Fixme.reg on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the merged successfully prompt.
______________________________

Navigate to C:\Windows\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Clean out your Temporary Internet files. Procede like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, click to select the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

We'll do a quick Ewido scan, only the registry.
Close ALL open Windows / Programs / Folders. Please start Ewido Security Suite, and run a full scan.
  • Click on Scanner
  • Click on Registry Scan
  • Let the program scan the machine.
If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first entry, put a checkmark in the lower left corner of the box that says Perform action on all infections, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.
  • Click Save Report button
  • Save the report to your Desktop
Close Ewido.
______________________________

Run Ad-Aware and Click on the Scan Now Button
  • Choose Perform Full System Scan
  • DESELECT Search for negligible risk entries, as negligible risk entries (MRU's) are not considered to be a threat. (make it show a red X)
Click Next to begin the scan. When the scan is completed, the Performing System Scan screen will change name to Scan Complete.

Click the Next Button to get to the Scanning Results Window where more information about the objects detected during the scan is available. Click the Critical Objects Tab. In general all of the items listed will be bad. To fix all the bad critical objects, right click on one of them, click the Select All entry in the pop-up menu to mark all entries. Click Next and then OK in the dialog box to confirm the removal.
______________________________

Run Spybot - S&D

Click the button Check for Problems
When Spybot is complete, it will be showing RED entries, BLACK entries and GREEN entries in the window.
Make sure that there is a check mark beside all of the RED entries ONLY.
Choose Fix Selected Problems and allow Spybot to fix the RED entries.

If it has trouble removing any spyware, you will get a message window, asking if it would be ok to run Spybot - S&D on the next reboot before any other applications start running. You should reply Yes to this. The next time you start Windows, Spybot will run automatically and fix any of the programs it could not fix previously.

At this point you will be presented with the list of found entries again, but now there will be large green checkmarks next to the items that Spybot - S&D was able to remove. The ones that are still checked but do not have the large green checkmark next to them will be fixed on the next reboot of windows.
______________________________

Run Winpfind from her account and please post a new HijackThis log, along with the Ewido log and the Winpfind.txt Could it be possible to just post them instead of placing them in a code box, it's easier to read. :)

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby cawitt » November 2nd, 2005, 12:49 am

Hey, Kim. Sorry for the "code" posts, I thought it would make it easier to read (I guess I was wrong!). Is there any special method for posting that would make it easier for you to read?

I was able to delete bachserv.exe just fine, but when I tried to delete defmtxdm.dll it wouldn't let me. So I downloaded a program called "MoveOnBoot" (at http://www.softwarepatch.com/software/moveonboot.html ) which allowed me to set it up for deletion upon next reboot. I guess I could have tried going into safe mode, but I was lazy ;) I hope that program isn't infected or anything, it looked legit. Anyway, it got rid of it on the next reboot, so it worked.

Here is the new HJT log:


Logfile of HijackThis v1.99.1
Scan saved at 10:37:26 PM, on 11/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {AEF76437-F960-4EBC-97EA-7BBB4230CF38} (OcarptMain Class) - https://oca.microsoft.com/en/secure/ocarpt.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.compani ... 3_16_0.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe


Ewido:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 9:45:41 PM, 11/1/2005
+ Report-Checksum: 64AC12AD

+ Scan result:

HKU\S-1-5-21-2166338481-2511679056-2105919262-1007\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> Spyware.MoneyMaker : Cleaned with backup
HKU\S-1-5-21-2166338481-2511679056-2105919262-1007\Software\Microsoft\Internet Explorer\Extensions\{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> Spyware.MoneyMaker : Cleaned with backup
HKU\S-1-5-21-2166338481-2511679056-2105919262-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6685509E-B47B-4F47-8E16-9A5F3A62F683} -> Spyware.MoneyMaker : Cleaned with backup


::Report End


And finally, WinPFind:


WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
aspack 11/1/2005 9:56:18 PM 45006848 C:\WINDOWS\MEMORY.DMP

Checking %System% folder...
PEC2 8/29/2002 6:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
PECompact2 10/4/2005 9:09:08 PM 2293088 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 10/4/2005 9:09:08 PM 2293088 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 2:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 2:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 8/29/2002 6:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\WBDBASE.DEU

Checking %System%\Drivers folder and sub-folders...
PTech 8/4/2004 12:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\ETC\HOSTS


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
11/1/2005 10:05:14 PM S 2048 C:\WINDOWS\BOOTSTAT.DAT
11/1/2005 10:35:00 PM H 24 C:\WINDOWS\pzY0M
10/13/2005 9:30:36 PM H 0 C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\6752e343d22c025be1f290a6267a146d\BITF.tmp
10/4/2005 8:17:40 PM S 21737 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896688.cat
9/28/2005 10:53:30 AM S 17402 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB900725.cat
9/9/2005 6:15:08 PM S 11084 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB901017.cat
11/1/2005 10:07:42 PM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
11/1/2005 10:05:18 PM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
11/1/2005 10:15:28 PM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
11/1/2005 10:31:06 PM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
11/1/2005 10:31:06 PM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
10/14/2005 5:02:40 PM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NTUSER.DAT.LOG
10/20/2005 10:41:22 PM HS 388 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\6eb5c3a9-300a-4acc-8007-8957cf937041
10/20/2005 10:41:22 PM HS 24 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\Preferred
11/1/2005 10:05:18 PM H 6 C:\WINDOWS\Tasks\SA.DAT

Checking for CPL files...
Microsoft Corporation 8/4/2004 2:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Broadcom Corporation 5/8/2003 8:25:18 PM 815104 C:\WINDOWS\SYSTEM32\B57exp.cpl
5/11/2001 1:00:00 AM 183808 C:\WINDOWS\SYSTEM32\bdeadmin.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Intel Corporation 4/7/2003 1:14:30 AM 94208 C:\WINDOWS\SYSTEM32\igfxcpl.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems 1/17/2004 5:44:48 PM 53352 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 8/29/2002 6:00:00 AM 187904 C:\WINDOWS\SYSTEM32\MAIN.CPL
Microsoft Corporation 8/4/2004 2:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 8/29/2002 6:00:00 AM 35840 C:\WINDOWS\SYSTEM32\NCPA.CPL
Microsoft Corporation 8/4/2004 2:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
RealNetworks, Inc. 1/17/2004 5:58:26 PM 24576 C:\WINDOWS\SYSTEM32\prefscpl.cpl
Apple Computer, Inc. 9/23/2004 6:57:40 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/29/2002 6:00:00 AM 28160 C:\WINDOWS\SYSTEM32\TELEPHON.CPL
Microsoft Corporation 8/4/2004 2:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 8/4/2004 2:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 3:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 5/26/2005 3:16:30 AM 174360 C:\WINDOWS\SYSTEM32\DLLCACHE\wuaucpl.cpl
Intel Corporation 4/7/2003 1:14:30 AM 94208 C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxcpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
9/3/2002 10:00:00 AM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI

Checking files in %ALLUSERSPROFILE%\Application Data folder...
9/3/2002 9:50:46 AM HS 62 C:\Documents and Settings\All Users\Application Data\DESKTOP.INI

Checking files in %USERPROFILE%\Startup folder...
9/3/2002 10:00:00 AM HS 84 C:\Documents and Settings\Susan Siu\Start Menu\Programs\Startup\DESKTOP.INI

Checking files in %USERPROFILE%\Application Data folder...
9/3/2002 9:50:46 AM HS 62 C:\Documents and Settings\Susan Siu\Application Data\DESKTOP.INI
5/28/2004 11:55:26 PM 0 C:\Documents and Settings\Susan Siu\Application Data\dm.ini
1/24/2004 4:18:08 PM 12358 C:\Documents and Settings\Susan Siu\Application Data\PFP110JCM.{PB
1/24/2004 4:18:08 PM 61678 C:\Documents and Settings\Susan Siu\Application Data\PFP110JPR.{PB

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\moveonboot_delete
{12B23346-6BD8-4812-BF8C-75E7C386ACB8} = C:\Program Files\GiPo@Utilities\GiPo@MoveOnBoot\mboot.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022}
= c:\progra~1\mcafee.com\vso\mcvsshl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\a2ContMenu
{AB77609F-2178-4E6F-9C4B-44AC179D937A} = C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022}
= c:\progra~1\mcafee.com\vso\mcvsshl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\QuickFinderMenu
{C0E10002-0028-0004-C0E1-C0E1C0E1C0E1} = c:\Program Files\WordPerfect Office 11\Programs\PFSE110.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
= C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
= C:\PROGRA~1\SPYBOT~1\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}
DriveLetterAccess = C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{BA52B914-B692-46c4-B683-905236F6F655} = McAfee VirusScan : c:\progra~1\mcafee.com\vso\mcvsshl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java Console : C:\WINDOWS\System32\msjava.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
ButtonText = Real.com :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer Band = %SystemRoot%\System32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IgfxTray C:\WINDOWS\System32\igfxtray.exe
HotKeysCmds C:\WINDOWS\System32\hkcmd.exe
dla C:\WINDOWS\system32\dla\tfswctrl.exe
VSOCheckTask "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
MCAgentExe c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MCUpdateExe C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
VirusScan Online C:\Program Files\McAfee.com\VSO\mcvsshld.exe
iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe"
OASClnt C:\Program Files\McAfee.com\VSO\oasclnt.exe
PCMService "C:\Program Files\Dell\Media Experience\PCMService.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Sonic RecordNow!

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mmtask
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item mmtask
hkey HKLM
command c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item mmtask
hkey HKLM
command c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item qttask
hkey HKLM
command "C:\Program Files\QuickTime\qttask.exe" -atboottime
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item qttask
hkey HKLM
command "C:\Program Files\QuickTime\qttask.exe" -atboottime
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RealTray
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item RealPlay
hkey HKLM
command C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item RealPlay
hkey HKLM
command C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UpdateManager
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item sgtray
hkey HKLM
command "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item sgtray
hkey HKLM
command "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
system.ini 0
win.ini 0
bootini 0
services 0
startup 2


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\Userinit.exe
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui
= igfxsrvc.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 11/1/2005 10:35:44 PM
cawitt
Regular Member
 
Posts: 27
Joined: October 17th, 2005, 10:57 pm

Unread postby Kimberly » November 2nd, 2005, 1:46 am

No worries, posted like that it's easy to read. :)

MoveOnBoot should be ok. You can do the same thing with Hijackthis (Open the Misc Tools Section > Delete a file on reboot) and for very stubborn ones, we use killbox. :)

Two more files to delete:

C:\WINDOWS\pzY0M <--- might be a folder, hard to tell
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\6752e343d22c025be1f290a6267a146d\BITF.tmp

One file to check, it's probably the Borland Database Engine control Panel icon (might be installed with Corel Products) but I want to be sure. Don't delete the file.

Navigate to C:\WINDOWS\SYSTEM32 folder and right-click on bdeadmin.cpl. Select Properties from the context menu that pops up, go to the Version tab, and get all the information you can from there (click on the individual Item Names under Other Version information so that you can see the details for each). Only post the info back if the file does not belong to Borland.

Other than that, the logs are ok. Do you still have so many BSOD ? The 0x0000000a can be related to hardware, a faulty driver (which was installed) or a software problem. 000000d1 seems to be related to an USB controller problem mainly. Does the 000000d1 occurs at boot or at shutdown most of the time ? Try to work a little bit with the PC and see how it behaves and let me know. The 0x0000000a can be caused by the presence of a rootkit ... we could always check that out if the problem persists.

Something else, the MS05-051 security update did cause some weirdness on some computers, I see it's installed - Security Update for Windows XP (KB902400) - dunno if it's related ...
http://www.vnunet.com/vnunet/news/21439 ... -microsoft

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby cawitt » November 3rd, 2005, 1:57 am

Ok, thanks for the tip!

I deleted the two files you listed.

The third, bdeadmin.cpl, did indeed belong to Borland.

Unfortunately, the system is still running slowly, and the BSODs still occur. Mainly they are happening upon boot into Windows. Sometimes it happens twice in a row, and then finally it will boot into Windows normally. Also, it happened twice during the Kaspersky scan. It seems to randomly give me either the 0x0000000a or the 000000d1. I can't seem to make it crash intentionally, it just does at random times, and sometimes on bootup. Are there any things I need to check out, or ways to go about figuring out what it is?

I went ahead and ran HJT again. Here's the new log:


Logfile of HijackThis v1.99.1
Scan saved at 11:43:47 PM, on 11/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\dllhost.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {AEF76437-F960-4EBC-97EA-7BBB4230CF38} (OcarptMain Class) - https://oca.microsoft.com/en/secure/ocarpt.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.compani ... 3_16_0.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
cawitt
Regular Member
 
Posts: 27
Joined: October 17th, 2005, 10:57 pm

Unread postby Kimberly » November 3rd, 2005, 11:13 am

Thanks for looking up the bdeadmin.cpl, you may leave the file alone, it's a legitimate file.

Ok, let's try to get some more info. First thing to do, is check a setting and modify it because I don't have the MS SDK installed to read minidump files. To view the Automatically Reboot option, right-click My Computer, click Properties, click the Advanced tab, and then click Settings under Startup and Recovery. If checked, uncheck the Automatically Reboot option. That way, the PC will dump everything on the BSOD and you will be able to read it before rebooting. To recover / reboot, simply press the button you usually press to start the PC. On some computers, you might need to press the reset button. The blue screen will list the error, 0x0000000a or the d1, and you might be able to spot the name of the file involved. Take note of it and let me know.

Since it did also happen while running Kaspersky, we have to look for a rootkit. I did include Silent Runners too, it will not reveal a rootkit but it shows me different locations of the registry than WinPFind.

Please RIGHT-CLICK HERE and Save As (in IE it's "Save Target As") to download Silent Runners to your Desktop.
Run Silent Runner's by doubleclicking the Silent Runners icon on your desktop.
You will see a text file appear on the desktop - it's not done, let it run (it won't appear to be doing anything!)
Once you receive the prompt "All Done!", it will produce a log named “StartupProgramsâ€
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby Kimberly » November 4th, 2005, 12:58 pm

Hello Chris,

Can you run this tool too please:

You may want to print out these instructions for reference, since you will have to restart your computer during the fix. You MUST run this tool in Safe Mode or it won't detect anything.

Please download AproposFix from here:
http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post the entire contents of the log.txt file in the aproposfix folder.

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby cawitt » November 5th, 2005, 12:56 am

The Auto-reboot opotion was already unchecked. I got the 0000000a again while Rootkit Revealer was running the first time.

Again the error is IRQL_NOT_LESS_OR_EQUAL and there's a message that says "Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need." Unfortunately, it did not list any specific file that it involved.

Here is the Silent Runners log:


"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Sonic RecordNow!" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["Sonic Solutions"]
"VSOCheckTask" = ""C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask" ["McAfee, Inc."]
"MCAgentExe" = "c:\PROGRA~1\mcafee.com\agent\mcagent.exe" ["McAfee, Inc"]
"MCUpdateExe" = "c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" ["McAfee, Inc"]
"VirusScan Online" = "C:\Program Files\McAfee.com\VSO\mcvsshld.exe" ["McAfee, Inc."]
"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."]
"OASClnt" = "C:\Program Files\McAfee.com\VSO\oasclnt.exe" ["McAfee, Inc."]
"PCMService" = ""C:\Program Files\Dell\Media Experience\PCMService.exe"" ["CyberLink Corp."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"McRegWiz" = "c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun" [empty string]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{5CA3D70E-1895-11CF-8E15-001234567890}\(Default) = "DriveLetterAccess" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Sonic\RecordNow!\shlext.dll" ["Sonic Solutions"]
"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{AB77609F-2178-4E6F-9C4B-44AC179D937A}" = "a² Context Menu Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
"load" = (value not set)
"run" = (value not set)

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
"AppInit_DLLs" = (value not set)

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
moveonboot_delete\(Default) = "{12B23346-6BD8-4812-BF8C-75E7C386ACB8}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\GiPo@Utilities\GiPo@MoveOnBoot\mboot.dll" ["Gibin Software House (http://www.gibinsoft.net)"]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
QuickFinderMenu\(Default) = "{C0E10002-0028-0004-C0E1-C0E1C0E1C0E1}"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\WordPerfect Office 11\Programs\PFSE110.DLL" ["Novell, Inc., c/o Corel Corporation Limited"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
a2ContMenu\(Default) = "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\A2FREE~1\A2CONT~1.DLL" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Susan Siu\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{BA52B914-B692-46C4-B683-905236F6F655}" = "McAfee VirusScan"
-> {CLSID}\InProcServer32\(Default) = "c:\progra~1\mcafee.com\vso\mcvsshl.dll" ["McAfee, Inc."]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\msjava.dll" [file not found]

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

ewido security suite control, ewido security suite control, "C:\Program Files\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
iPod Service, iPodService, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Computer, Inc."]
McAfee Task Scheduler, McTskshd.exe, "c:\PROGRA~1\mcafee.com\agent\mctskshd.exe" ["McAfee, Inc"]
McAfee WSC Integration, McDetect.exe, "c:\program files\mcafee.com\agent\mcdetect.exe" ["McAfee, Inc"]
McAfee.com McShield, McShield, "c:\PROGRA~1\mcafee.com\vso\mcshield.exe" ["McAfee Inc."]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 82 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 21 seconds.
---------- (total run time: 138 seconds)


Rootkit Revealer:


HKLM\SOFTWARE\CzXltAFmegF5 10/23/2005 1:24 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SENS 9/3/2002 4:05 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SFL350P 10/18/2005 8:59 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\Serial 11/4/2005 10:11 PM 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\Sfl350p 11/4/2005 10:11 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe 11/4/2005 12:16 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\ace.dll 10/18/2005 8:59 PM 568.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\AI_01-11-2005.log 11/1/2005 8:53 PM 3 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\AI_02-11-2005.log 11/2/2005 8:56 PM 3 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\AI_03-11-2005.log 11/3/2005 6:17 PM 3 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\AI_04-11-2005.log 11/4/2005 1:49 PM 3 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\AI_31-10-2005.log 10/31/2005 8:12 PM 3 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache 11/4/2005 3:14 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_4356cce3_000a4083 11/4/2005 10:14 PM 12 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_435849ba_00022551 10/20/2005 8:51 PM 11.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_435bd442_00089544 10/23/2005 1:19 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_435c020e_0008583b 10/23/2005 4:35 PM 237.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_435d7fd4_000d59f8 10/24/2005 7:44 PM 239.83 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_435ec120_00031975 10/25/2005 6:34 PM 65.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_43603b2e_000ca2dd 10/26/2005 9:27 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_43615d80_0000f424 11/4/2005 1:56 PM 34.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_4366bb28_000b34a7 10/31/2005 7:47 PM 11.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_4366cb98_00007a12 10/31/2005 8:57 PM 39.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_43682487_00076417 11/1/2005 9:29 PM 53.32 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_436834a5_0009c671 11/1/2005 10:38 PM 18.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_436940f0_000af79e 11/2/2005 5:42 PM 64.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_43697163_0007de29 11/2/2005 9:09 PM 202.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000029_436baf33_0002dc6c 11/4/2005 1:57 PM 13.85 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000035_435ee310_0008bd14 10/25/2005 8:59 PM 228.62 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000035_43617735_00003d09 10/27/2005 7:56 PM 11.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000035_43680386_0006acfc 11/1/2005 7:08 PM 31.23 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000035_436ab7b3_0005b8d8 11/3/2005 8:21 PM 2.88 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000008e_436acad3_0008583b 11/3/2005 9:43 PM 2.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000099_435ec4a3_00016e36 10/25/2005 6:49 PM 92.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000099_43615ea8_000a4083 10/27/2005 6:27 PM 6.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000099_4367f7bc_000e1113 11/1/2005 6:18 PM 17.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000099_43695053_000c65d4 11/2/2005 6:48 PM 2.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000099_436a9c6b_0006acfc 11/3/2005 6:25 PM 233.26 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000099_436b9ba7_000a7d8c 11/4/2005 12:50 PM 75.92 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000099_436bbc35_00029f63 11/4/2005 2:53 PM 1 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000120_435ec9b4_0005f5e1 10/25/2005 7:11 PM 44.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000120_436aabf7_00040d99 11/3/2005 7:31 PM 148.73 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000120_436bdec2_000ca2dd 11/4/2005 5:20 PM 496 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000124_435bd478_0002dc6c 11/4/2005 12:26 PM 3.90 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000124_435ec4b9_000a7d8c 10/25/2005 6:50 PM 103.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000124_43615f8c_00057bcf 10/27/2005 6:15 PM 168.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000124_4367f7c6_0003d090 11/1/2005 6:22 PM 16.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000124_43695054_000e1113 11/2/2005 6:48 PM 2.98 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000124_43699321_0006c7ac 11/2/2005 11:33 PM 5.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000124_436a9c6b_000d9701 11/3/2005 6:25 PM 5.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001d3_435ee360_00025fa8 10/25/2005 9:01 PM 5.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001d3_43617735_000c65d4 10/27/2005 7:56 PM 32.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001d3_4368047a_00053ec6 11/1/2005 7:12 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001d3_436ab825_0004c4b4 11/3/2005 8:24 PM 73.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001e1_436ac6c3_0001e848 11/3/2005 9:26 PM 5.99 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_4356cde2_000aba95 10/19/2005 5:51 PM 5.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_43584e28_00098968 10/20/2005 9:10 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_4367f77d_000c65d4 11/1/2005 6:17 PM 6.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_43695043_000dd40a 11/3/2005 8:20 PM 4 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_43699272_000bc969 11/2/2005 11:34 PM 5.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_436a9c24_00022551 11/3/2005 6:24 PM 3.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_436b9b5a_00040d99 11/4/2005 5:22 PM 4.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000001eb_436bbc21_000b71b0 11/4/2005 2:53 PM 233.41 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000030a_435ec98c_00040d99 10/25/2005 7:10 PM 954 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000030a_4367f876_0005f5e1 11/1/2005 6:21 PM 199.78 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000030a_436a9f76_0004c4b4 11/3/2005 6:38 PM 1.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000030a_436b9dea_000ca2dd 11/4/2005 12:44 PM 63.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000030a_436bdec1_000e8b25 11/4/2005 5:22 PM 1.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000384_435ed5fa_000f0537 10/25/2005 8:05 PM 110.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000384_4361696d_000b71b0 10/27/2005 7:00 PM 104.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000384_436ab59e_0009c671 11/3/2005 8:13 PM 4.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000384_436ba61f_00094c5f 11/4/2005 1:19 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000390_436ac63e_000632ea 11/3/2005 9:23 PM 8.55 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000047e_435ecf72_0007270e 10/25/2005 7:36 PM 2.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000047e_4361675e_00007a12 10/27/2005 6:48 PM 50.83 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000047e_4367fe9b_00098968 11/1/2005 6:47 PM 97.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000047e_436ab0ff_000ec82e 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000047e_436ba514_000d1cef 11/4/2005 1:14 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000588_4368096e_00000000 11/1/2005 7:33 PM 51.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000588_436abce4_00016e36 11/3/2005 8:44 PM 53.73 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000633_43680527_0005f5e1 11/1/2005 7:15 PM 239.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000633_436ab952_00007a12 11/3/2005 8:28 PM 38.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000677_435ed61a_000cdfe6 10/25/2005 8:04 PM 20.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000677_436169d3_0000f424 10/27/2005 7:00 PM 158.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000677_43680082_00029f63 11/1/2005 6:55 PM 36.26 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000677_436ab66b_0003d090 11/3/2005 8:16 PM 53.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000677_436ba62a_000e4e1c 11/4/2005 1:19 PM 178.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000006e3_436ac9de_000b34a7 11/3/2005 9:39 PM 10.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000728_436ac651_00044aa2 11/3/2005 9:24 PM 8.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000732_435ec9b3_000f0537 10/25/2005 7:11 PM 396 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000732_4367fab4_000dd40a 11/1/2005 6:31 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000732_436aabf5_00076417 11/3/2005 7:31 PM 115.41 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000732_436b9e0a_000487ab 11/4/2005 12:45 PM 96.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000732_436bdec2_00094c5f 11/4/2005 5:20 PM 1.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_4356d1a3_0003d090 10/19/2005 6:07 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_435bd49a_00007a12 10/23/2005 1:21 PM 80.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_435ec5fe_000baeb9 10/25/2005 6:55 PM 15.84 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_436160a0_0004c4b4 10/27/2005 6:20 PM 47 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_4367f828_000b71b0 11/1/2005 6:20 PM 3.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_4369507a_000bebc2 11/2/2005 6:49 PM 2.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_43699538_0009e121 11/2/2005 11:42 PM 11.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_436a9e34_00039387 11/3/2005 6:33 PM 4.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000074d_436b9c1c_0007de29 11/4/2005 12:38 PM 60.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000007cf_435ee316_000a3162 10/25/2005 8:59 PM 212.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000007cf_43617735_00044aa2 10/27/2005 7:56 PM 1.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000007cf_436803c7_0000b71b 11/1/2005 7:09 PM 27.55 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000007cf_436ab7b4_000af79e 11/3/2005 8:21 PM 2.89 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000822_435ecdd0_000a4083 10/25/2005 7:29 PM 81.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000822_43616543_000d9701 10/27/2005 6:39 PM 5.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000822_4367fca5_000d9701 11/1/2005 6:39 PM 28.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000822_43695972_000bebc2 11/2/2005 7:27 PM 9.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000822_436aaed2_0001e848 11/3/2005 7:45 PM 8.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000822_436be9be_0001ab3f 11/4/2005 6:07 PM 415 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000086a_43680b7e_00040d99 11/1/2005 7:42 PM 32.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000878_436ac7b1_0006ea05 11/3/2005 9:30 PM 14.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000902_435eced8_0008d24d 10/25/2005 7:33 PM 82.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000902_436165a8_00000000 10/27/2005 6:41 PM 82.47 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000902_436959fd_000e4e1c 11/2/2005 7:29 PM 18.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000902_436aaffa_000f0537 11/3/2005 7:48 PM 857 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000902_436be9fe_000b34a7 11/4/2005 6:08 PM 230.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000940_43680bab_000e8b25 11/1/2005 7:43 PM 27.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000975_4361776a_000c28cb 10/27/2005 7:57 PM 32.08 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000975_43680488_0008d24d 11/1/2005 7:12 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000975_436ab893_0001312d 11/3/2005 8:25 PM 129.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000975_436ba9b6_00053ec6 11/4/2005 1:34 PM 13.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000009ce_43618471_0007270e 10/27/2005 8:52 PM 37.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000009ce_43680ae4_000501bd 11/1/2005 7:40 PM 84.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000a28_4361838d_00016e36 10/27/2005 8:49 PM 3.23 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000a28_43680adf_00098968 11/1/2005 7:39 PM 84.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000a28_436abdac_0009c671 11/4/2005 4:58 PM 99.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000a4a_436abc23_000c28cb 11/3/2005 8:42 PM 72.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000a6c_436ac9e1_00094c5f 11/3/2005 9:39 PM 10.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bb3_43584e28_000c28cb 10/20/2005 9:10 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bb3_4367f786_00000000 11/1/2005 6:17 PM 1.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bb3_43695044_0001e848 11/3/2005 8:20 PM 974 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bb3_43699276_000bc969 11/2/2005 11:30 PM 355 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bb3_436b9b5a_0007de29 11/4/2005 12:33 PM 4.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bb3_436bbc22_0007de29 11/4/2005 2:53 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bdb_435ec998_00094c5f 10/25/2005 7:11 PM 23.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bdb_4367f876_000d59f8 11/1/2005 6:21 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bdb_436a9fc8_000af79e 11/3/2005 6:39 PM 6.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bdb_436b9df1_0005b8d8 11/4/2005 5:21 PM 705 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000bdb_436bdec2_0004c4b4 11/4/2005 5:22 PM 1.12 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c15_435862ba_00031975 10/20/2005 10:38 PM 28.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c15_43617c97_00076417 10/27/2005 8:19 PM 92.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c15_43680524_000a037a 11/1/2005 7:15 PM 175.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c15_436ab949_00089544 11/3/2005 8:29 PM 138.64 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c7b_435862b3_000e1113 10/23/2005 7:11 PM 624 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c7b_43617c07_00022551 10/27/2005 8:16 PM 1.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c7b_436804e5_000a4083 11/1/2005 7:14 PM 225.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000c7b_436ab939_000aba95 11/3/2005 8:28 PM 36.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ce1_436ac445_00057bcf 11/3/2005 9:15 PM 14.42 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000d66_435ecf87_000a4083 10/25/2005 7:36 PM 229.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000d66_4361676b_000f0537 10/27/2005 6:49 PM 114.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000d66_4367fed8_0001e848 11/1/2005 6:48 PM 60.92 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000d66_436ab10e_0005f5e1 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000d66_436ba52e_00044aa2 11/4/2005 1:15 PM 1.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000d6a_43680c54_0002625a 11/1/2005 7:46 PM 76.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000d6a_436ac092_000d59f8 11/4/2005 2:13 PM 22.86 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ddc_435ecc06_0005b8d8 10/25/2005 7:21 PM 26.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ddc_4367fbb7_0003d090 11/1/2005 6:36 PM 29.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ddc_436aad41_00003d09 11/3/2005 7:37 PM 145.92 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ddc_436b9fdd_00057bcf 11/4/2005 12:52 PM 937 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ddc_436be87e_000b71b0 11/4/2005 6:02 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000de5_43618218_00053ec6 10/27/2005 8:42 PM 8.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000de5_43680a2d_00076417 11/3/2005 9:22 PM 1.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000de5_436abd58_0002625a 11/3/2005 8:46 PM 78.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e12_435ed6a4_00031975 10/25/2005 8:06 PM 103.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e12_43616a65_0000b71b 10/27/2005 7:01 PM 104.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e12_4368015a_0007270e 11/1/2005 6:59 PM 80.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e12_436ab6c0_000d9701 11/3/2005 8:17 PM 18.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e90_435eee12_000de105 10/25/2005 9:46 PM 47.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e90_43617735_000dd40a 10/27/2005 7:56 PM 640 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e90_43680480_000dd40a 11/1/2005 7:12 PM 193.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e90_436ab82c_000bebc2 11/3/2005 8:23 PM 16.03 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000e90_436ba85f_000baeb9 11/4/2005 1:28 PM 14.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ecc_435ee34e_0003f903 10/25/2005 9:00 PM 424 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ecc_43617735_000b71b0 10/27/2005 7:56 PM 5.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ecc_43680476_00081b32 11/1/2005 7:12 PM 168.49 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ecc_436ab7ba_00089544 11/3/2005 8:22 PM 2.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000ecc_436ba83e_0002dc6c 11/4/2005 1:28 PM 9.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000f3e_435ec45b_000a4083 10/25/2005 6:56 PM 91.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000f3e_43615e99_0000b71b 11/4/2005 12:44 PM 4.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000f3e_4367f7b4_00022551 11/1/2005 6:18 PM 13.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000f3e_43695052_000a7d8c 11/2/2005 6:48 PM 2.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000f3e_436a9c69_000487ab 11/3/2005 6:25 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000f3e_436b9ba2_0001e848 11/4/2005 12:34 PM 3.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000f3e_436bbc34_00090f56 11/4/2005 2:53 PM 1 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fbf_435ecf67_00057bcf 10/25/2005 7:35 PM 52.35 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fbf_436166c0_000af79e 10/27/2005 6:46 PM 398 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fbf_4367fe66_00031975 11/1/2005 6:46 PM 52.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fbf_436ab0f2_0001ab3f 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fbf_436ba50b_0007a120 11/4/2005 1:14 PM 225.89 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fc9_435ed6a0_000e1113 10/25/2005 8:06 PM 114.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fc9_43616a5e_000501bd 10/27/2005 7:01 PM 51.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fc9_436ab6c0_00098968 11/3/2005 8:17 PM 5.89 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00000fc9_436ba644_000a4083 11/4/2005 1:19 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001030_436ac6d8_0006ea05 11/3/2005 9:26 PM 8.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001049_43680b7b_000f0537 11/1/2005 7:42 PM 32.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001049_436abf00_00016e36 11/3/2005 8:54 PM 7.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000010d9_436ac670_00031975 11/3/2005 9:24 PM 579 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000113e_436ac93a_000c65d4 11/3/2005 9:36 PM 12.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000011f4_435edfc3_00053ec6 10/25/2005 8:45 PM 17.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000011f4_4361762b_0005b8d8 10/27/2005 7:51 PM 69.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000011f4_436ab737_000487ab 11/3/2005 8:20 PM 13.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000121f_435ecec6_000c28cb 10/25/2005 7:33 PM 213.14 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000121f_43616573_000d9701 10/27/2005 6:40 PM 140.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000121f_4367fcaa_000632ea 11/1/2005 6:39 PM 4.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000121f_436959a8_0003567e 11/2/2005 7:28 PM 14.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000121f_436aafca_0002625a 11/3/2005 7:48 PM 45.78 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000121f_436be9e9_000ca2dd 11/4/2005 6:08 PM 151.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001238_435bd4e0_00057bcf 10/23/2005 1:22 PM 78.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001238_435ec792_00003d09 10/25/2005 7:09 PM 110.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001238_436161a8_00003d09 10/27/2005 6:25 PM 11.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001238_4367f848_000ec82e 11/1/2005 6:20 PM 33.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001238_436a9ecb_000ca2dd 11/3/2005 6:35 PM 409 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001238_436bd82f_0001312d 11/4/2005 4:52 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000127e_435ee305_00061285 10/25/2005 8:59 PM 209.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000127e_43617734_000d1cef 10/27/2005 7:56 PM 531 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000127e_4368037e_00090f56 11/1/2005 7:08 PM 30.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_43584e29_00007a12 10/20/2005 9:10 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_435ec3c3_000dd40a 10/25/2005 6:46 PM 91.99 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_43615e7a_000ca2dd 10/27/2005 6:10 PM 96.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_4367f797_000501bd 11/1/2005 6:17 PM 5.62 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_43695044_00094c5f 11/3/2005 8:20 PM 590 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_4369927e_000ee2de 11/2/2005 11:34 PM 2.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_436a9c47_0002625a 11/3/2005 6:24 PM 16.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_436b9b60_00053ec6 11/4/2005 12:33 PM 72.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012db_436bbc25_00053ec6 11/4/2005 2:53 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012e1_435eceba_00031975 10/25/2005 7:32 PM 4.47 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012e1_43616565_0003567e 10/27/2005 6:40 PM 112.23 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012e1_4367fca7_00066ff3 11/1/2005 6:39 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012e1_436aaf96_00007a12 11/3/2005 7:47 PM 51.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000012e1_436be9dd_00094c5f 11/4/2005 6:08 PM 139.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001316_43617d1d_0008583b 10/27/2005 8:21 PM 96.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001316_436abc6c_000632ea 11/3/2005 8:42 PM 8.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001366_435eccff_0005f5e1 10/25/2005 7:25 PM 75.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001366_43616475_00053ec6 10/27/2005 6:41 PM 12.42 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001366_4367fc22_0005b8d8 11/1/2005 6:37 PM 36.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001366_4369589f_000a037a 11/2/2005 7:23 PM 1.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001366_436aadb2_00007a12 11/3/2005 7:39 PM 104.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001366_436b9ffe_00031975 11/4/2005 12:53 PM 72.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001366_436be8ae_0007de29 11/4/2005 6:03 PM 5.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000138a_43680b36_0002625a 11/1/2005 7:41 PM 3.90 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000138a_436abe37_0000b71b 11/3/2005 8:49 PM 10.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000139d_435ecee4_000d9701 10/25/2005 7:33 PM 216.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000139d_4367fced_00000000 11/1/2005 6:40 PM 22.03 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000139d_43695a4e_0007270e 11/3/2005 6:24 PM 65.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000139d_436aaffb_0003567e 11/3/2005 7:48 PM 803 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000139d_436bea11_0002dc6c 11/4/2005 6:09 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013d3_4361838b_000a7d8c 10/27/2005 8:48 PM 37.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013d3_43680acc_000cdfe6 11/1/2005 7:39 PM 30.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013d3_436abd86_000d9701 11/3/2005 8:46 PM 52.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013e9_435ecf2f_000c28cb 10/25/2005 7:34 PM 8.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013e9_4361668e_0009c671 10/27/2005 6:45 PM 69.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013e9_4367fd83_00031975 11/1/2005 6:44 PM 78.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013e9_43695a72_000f0537 11/2/2005 7:31 PM 2.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013e9_436ab04b_000b34a7 11/3/2005 7:50 PM 13.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013e9_436ba4d7_00029f63 11/4/2005 1:13 PM 233.23 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000013e9_436bea59_000c65d4 11/4/2005 6:10 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001481_435860e9_000c28cb 10/20/2005 10:30 PM 113.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001481_4361785c_0003d090 10/27/2005 8:01 PM 70.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001481_436804b7_000f0537 11/1/2005 7:13 PM 208.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001481_436ab8ed_000cdfe6 11/3/2005 8:27 PM 46.14 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001481_436baa69_00022551 11/4/2005 1:37 PM 2.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_43584e29_00039387 10/20/2005 9:10 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_435bd477_000487ab 10/23/2005 1:20 PM 97.62 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_43615e80_00000000 10/27/2005 6:10 PM 83.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_43695046_00044aa2 11/3/2005 8:20 PM 37.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_43699280_0004a25b 11/2/2005 11:30 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_436a9c55_000487ab 11/3/2005 6:25 PM 17.26 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_436b9b60_000ca2dd 11/4/2005 12:33 PM 4.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000153c_436bbc2f_00076417 11/4/2005 2:53 PM 232.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_4356d199_000b71b0 11/4/2005 12:23 PM 3.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_435bd48a_000cdfe6 10/23/2005 1:20 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_435ec59d_0006ea05 10/25/2005 8:44 PM 110.14 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_43616098_00098968 10/27/2005 6:19 PM 228.49 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_4367f816_0008583b 11/1/2005 6:19 PM 18 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_43695074_0007270e 11/2/2005 6:49 PM 2.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_43699354_0003ae37 11/2/2005 11:34 PM 1.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_436a9c8d_00098968 11/3/2005 6:26 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_436b9bd2_0007a120 11/4/2005 12:35 PM 4.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001547_436bc0aa_000a7d8c 11/4/2005 3:12 PM 827 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000015a1_435ecd34_000bebc2 10/25/2005 7:26 PM 50.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000015a1_43616537_00044aa2 10/27/2005 6:39 PM 57.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000015a1_4367fc8c_000a037a 11/1/2005 6:38 PM 54.13 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000015a1_43695939_00089544 11/2/2005 7:26 PM 15.32 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000015a1_436aae38_000f0537 11/3/2005 7:41 PM 102.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000015a1_436be981_0000b71b 11/4/2005 6:06 PM 148.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001643_4361820b_000ca2dd 10/27/2005 8:48 PM 124.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001643_43680a2d_00053ec6 11/3/2005 9:22 PM 1.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001643_436abd50_000ec82e 11/3/2005 8:45 PM 139.90 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_4356cd48_000b71b0 11/4/2005 10:14 PM 12 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_43584e24_0000f424 10/20/2005 9:10 PM 4 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_435bd471_000baeb9 10/23/2005 1:20 PM 62.62 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_435c27d3_000c28cb 10/23/2005 7:16 PM 66.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_435ec330_000ca2dd 10/25/2005 6:43 PM 159.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_436825a0_0001312d 11/1/2005 9:34 PM 4.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_4369501f_0000b71b 11/3/2005 8:21 PM 14.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_43699270_00014bdd 11/2/2005 11:34 PM 146 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_436a9c1a_0006acfc 11/3/2005 6:24 PM 4.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_436b9991_00076417 11/4/2005 12:25 PM 3.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001649_436bbb6f_0009c671 11/4/2005 2:50 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000169a_436ac5b2_000f0537 11/3/2005 9:21 PM 5.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016c5_435ecf02_00029f63 10/25/2005 7:34 PM 6.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016c5_4367fd41_00098968 11/1/2005 6:41 PM 37.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016c5_43695a68_000e4e1c 11/2/2005 7:31 PM 2.98 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016c5_436ab028_000b71b0 11/3/2005 7:49 PM 13.35 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016c5_436ba2d0_0007de29 11/4/2005 5:23 PM 1.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016c5_436bea55_00039387 11/4/2005 6:10 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016d4_4358629b_00003d09 10/20/2005 10:38 PM 82.47 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016d4_43617c01_0005f5e1 11/4/2005 5:22 PM 711 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016d4_436804d8_000d1cef 11/1/2005 7:14 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000016d4_436ab92c_0005b8d8 11/3/2005 8:28 PM 36.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001796_43617cd7_000dd40a 10/27/2005 8:20 PM 2.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001796_436abb4d_000e4e1c 11/3/2005 8:37 PM 176.13 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000182f_4368081f_000a4083 11/1/2005 7:28 PM 63.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000182f_436abb91_000e1113 11/3/2005 8:38 PM 30.47 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001850_4358629a_0008583b 10/27/2005 9:14 PM 12.42 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001850_43617ba1_000e1113 10/27/2005 8:15 PM 89.26 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001850_436804d7_000a4083 11/1/2005 7:14 PM 227.84 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001850_436ab925_00000000 11/3/2005 8:28 PM 76.13 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000187e_435ecf01_000e8b25 10/25/2005 7:34 PM 729 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000187e_43616640_0001ab3f 10/27/2005 6:44 PM 249.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000187e_4367fd34_00076417 11/1/2005 6:41 PM 40.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000187e_43695a64_000aba95 11/2/2005 7:31 PM 2.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000187e_436ab023_0005f5e1 11/3/2005 7:49 PM 13.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000187e_436ba2cd_000487ab 11/4/2005 1:05 PM 98.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000187e_436bea55_0000b71b 11/4/2005 6:10 PM 205.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_4356cd02_00044aa2 11/2/2005 11:44 PM 157 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_435849d2_00007a12 10/20/2005 8:52 PM 11.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_435bd445_00031975 10/23/2005 1:19 PM 30.08 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_435c02a5_000d59f8 10/23/2005 7:13 PM 30.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_435d7feb_000501bd 10/24/2005 7:44 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_435ec240_00066ff3 10/25/2005 6:46 PM 65.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_43603b2f_000501bd 10/26/2005 9:27 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_43615dc1_0008d24d 10/27/2005 6:07 PM 35.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_4366bb3e_0007de29 10/31/2005 7:47 PM 82.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_4366ce21_000a4083 10/31/2005 9:08 PM 18.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_4367f749_000bebc2 11/1/2005 6:16 PM 490 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_43682490_0006acfc 11/1/2005 9:29 PM 4.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_436835e1_0000b71b 11/1/2005 10:43 PM 48.32 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_436940fb_0001e848 11/2/2005 5:44 PM 21.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_4369716f_00007a12 11/2/2005 9:09 PM 26.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_436b9958_0001e848 11/4/2005 12:24 PM 96.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018be_436bb2f4_0003d090 11/4/2005 3:14 PM 23.90 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018d7_435ed63f_000f0537 10/25/2005 8:05 PM 147.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018d7_4368009d_000a037a 11/1/2005 6:56 PM 32.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018d7_436ab683_000ca2dd 11/3/2005 8:16 PM 3.62 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000018d7_436ba62d_000dd40a 11/4/2005 1:19 PM 10.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001916_435ed457_000af79e 10/25/2005 7:56 PM 174.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001916_43680002_00022551 11/1/2005 6:53 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001916_436ab3a0_00094c5f 11/3/2005 8:04 PM 5.41 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001916_436ba609_000d59f8 11/4/2005 1:18 PM 233.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001953_435ed673_000dd40a 10/25/2005 8:05 PM 140.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001953_43616a46_0005b8d8 11/1/2005 6:49 PM 56.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001953_4368013b_000e1113 11/1/2005 6:58 PM 37.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001953_436ab6b1_00098968 11/3/2005 8:17 PM 13.20 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001953_436ba632_000b71b0 11/4/2005 1:19 PM 5.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000019d9_43680494_0006ea05 11/1/2005 7:13 PM 5.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000019d9_436ab8b7_000501bd 11/3/2005 8:27 PM 80.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000019d9_436ba9d1_00040d99 11/4/2005 1:34 PM 13.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000019da_43680533_000ec82e 11/1/2005 7:15 PM 235.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000019da_436abab8_00022551 11/3/2005 8:34 PM 79.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001a49_435ecaf4_00066ff3 10/25/2005 8:41 PM 69.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001a49_4367fada_0000f424 11/1/2005 6:31 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001a49_436aac6c_00057bcf 11/3/2005 7:33 PM 148.42 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001a49_436b9e38_00076417 11/4/2005 12:45 PM 95.85 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001a49_436bdf3c_00031975 11/4/2005 5:22 PM 95.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001ad4_435bd4e4_00039387 11/4/2005 5:23 PM 34.26 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001ad4_435ec805_000b71b0 10/25/2005 7:04 PM 111.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001ad4_43616262_0008d24d 10/27/2005 6:27 PM 97.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001ad4_4369542c_0006acfc 11/2/2005 7:05 PM 6.55 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001ad4_436a9ef8_000f0537 11/3/2005 6:36 PM 230.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001ad4_436bd943_000cdfe6 11/4/2005 4:57 PM 231.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001af4_435ee34d_000c13bd 10/25/2005 9:00 PM 230.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001af4_43617735_000a037a 10/27/2005 7:56 PM 77 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001af4_43680474_00039387 11/1/2005 7:12 PM 406 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001af4_436ab7b9_00057bcf 11/3/2005 8:22 PM 2.90 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001af4_436ba83a_000e8b25 11/4/2005 1:28 PM 20.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001cd0_435ecd0f_0007270e 10/25/2005 7:25 PM 61.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001cd0_43616475_00090f56 10/27/2005 6:36 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001cd0_4367fc34_00081b32 11/1/2005 6:37 PM 36.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001cd0_436958c4_000cdfe6 11/2/2005 7:24 PM 58.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001cd0_436aadbb_000d9701 11/3/2005 7:39 PM 128.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001cd0_436be8ae_0009c671 11/4/2005 6:03 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001cdf_436ac922_0007de29 11/3/2005 9:36 PM 1.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001d18_4368052a_000b71b0 11/1/2005 7:15 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001d18_436aba9d_0003567e 11/3/2005 8:34 PM 53.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001d3f_436ac9c6_0006ea05 11/3/2005 9:39 PM 7.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001d5e_436ac9ca_00040d99 11/3/2005 9:39 PM 6.84 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001dc0_43585f7d_0001ab3f 10/24/2005 7:43 PM 164.92 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001dc0_43617838_00066ff3 10/27/2005 8:00 PM 77.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001dc0_43680498_0007de29 11/1/2005 7:13 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001dc0_436ab8d6_000b34a7 11/3/2005 8:26 PM 45.55 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001dc0_436baa14_000d59f8 11/4/2005 1:36 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_435bd4e1_00029f63 11/4/2005 12:36 PM 4.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_435ec7ce_00003d09 10/25/2005 7:03 PM 150.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_436161f3_00022551 10/27/2005 6:25 PM 3.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_4367f849_0005b8d8 11/1/2005 6:20 PM 3.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_43695424_00003d09 11/2/2005 7:04 PM 35.88 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_43699621_00068aa3 11/2/2005 11:46 PM 55.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_436a9eda_000ca2dd 11/3/2005 6:35 PM 148.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_436b9c29_000af79e 11/4/2005 12:36 PM 4.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001e1f_436bd941_000d9701 11/4/2005 4:57 PM 120.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001f16_43617cfb_00022551 10/27/2005 8:20 PM 74.35 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001f16_436807bd_0007de29 11/1/2005 7:26 PM 22.12 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001f16_436abb8b_0008d24d 11/3/2005 8:40 PM 13.85 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00001ff1_436ac9d5_0001ab3f 11/3/2005 9:39 PM 9.99 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002059_435ee302_00077dd3 10/25/2005 8:59 PM 4.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002059_43617734_000aba95 10/27/2005 7:56 PM 333 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002059_43680372_000bebc2 11/1/2005 7:08 PM 384 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002059_436ab7aa_000501bd 11/3/2005 8:21 PM 16.86 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000212c_436acacc_00053ec6 11/3/2005 9:43 PM 4.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002213_435ec8fe_0007de29 10/25/2005 7:08 PM 51.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002213_436162a0_000f0537 10/27/2005 6:28 PM 3.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002213_4367f871_0000f424 11/1/2005 6:21 PM 223.83 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002213_43695529_00000000 11/2/2005 7:09 PM 33.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002213_436a9f73_000d1cef 11/3/2005 6:38 PM 120.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002213_436bdeba_000b34a7 11/4/2005 5:20 PM 1.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022cd_435ed3ad_0007a120 10/25/2005 7:54 PM 525 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022cd_4367ff67_00089544 11/1/2005 6:51 PM 60.20 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022cd_436ab34b_000b34a7 11/3/2005 8:03 PM 7.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022cd_436ba5f4_000632ea 11/4/2005 1:18 PM 4.03 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022ee_435eca0f_0002625a 10/25/2005 7:13 PM 30.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022ee_43616313_00044aa2 10/27/2005 6:30 PM 102.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022ee_4367fac1_000d59f8 11/1/2005 6:31 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022ee_436aac21_000d59f8 11/3/2005 7:32 PM 115.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000022ee_436bdec5_00040d99 11/4/2005 5:22 PM 4.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002350_435ec9ff_00016e36 10/25/2005 7:12 PM 33.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002350_436162bb_00007a12 10/27/2005 6:28 PM 48.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002350_4367fac1_0001ab3f 11/1/2005 6:31 PM 4.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002350_436aac03_00094c5f 11/3/2005 7:32 PM 152.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002350_436bdec4_00090f56 11/4/2005 5:22 PM 705 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000023c9_436166ab_0006ea05 10/27/2005 6:45 PM 24.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000023c9_436ab0a8_000a037a 11/3/2005 7:58 PM 22.62 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000023c9_436ba4f9_000632ea 11/4/2005 1:14 PM 430.64 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000023c9_436beaeb_00016e36 11/4/2005 6:12 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002462_436ac94b_000bebc2 11/3/2005 9:37 PM 12.22 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000249e_435edfb2_0002dc6c 10/25/2005 8:45 PM 231.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000249e_436175c6_00031975 10/27/2005 7:50 PM 24.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000249e_436802ad_00003d09 11/1/2005 7:05 PM 384 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000249e_436ab6f2_00016e36 11/3/2005 8:18 PM 7.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000251f_4368052a_0002dc6c 11/1/2005 7:15 PM 216.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000251f_436ab95a_000e1113 11/3/2005 8:28 PM 38.14 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002528_436ac2b5_0002625a 11/3/2005 9:40 PM 785 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000252a_4361782f_00089544 10/27/2005 8:00 PM 4.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000252a_43680494_000a4083 11/1/2005 7:13 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000252a_436ab8ce_00081b32 11/3/2005 8:26 PM 45.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000252a_436ba9d8_00039387 11/4/2005 1:35 PM 13.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000260d_435ec989_0003567e 10/25/2005 7:10 PM 53.89 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000260d_4367f871_0007270e 11/1/2005 6:21 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000260d_4369552d_0006ea05 11/2/2005 7:09 PM 24.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000260d_436a9f76_0001ab3f 11/3/2005 6:38 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000260d_436b9ca7_000a037a 11/4/2005 12:38 PM 4.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000260d_436bdec0_0000b71b 11/4/2005 5:20 PM 61.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000261e_435ed401_000a7d8c 10/25/2005 7:55 PM 175.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000261e_4361680a_0008d24d 10/27/2005 6:51 PM 52.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000261e_4367ff78_0001312d 11/1/2005 6:51 PM 46.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000261e_436ab373_0008d24d 11/3/2005 8:03 PM 50.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000261e_436ba5f7_00053ec6 11/4/2005 1:18 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000263d_436189af_000b34a7 10/27/2005 9:15 PM 24.86 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000263d_43680b0a_000bebc2 11/1/2005 7:40 PM 55.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000263d_436abe12_0007a120 11/3/2005 8:49 PM 15.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002668_43680b76_0006ea05 11/1/2005 7:44 PM 26.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002668_436abee8_000e4e1c 11/3/2005 8:54 PM 8.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_435bd4c0_0006ea05 10/23/2005 1:21 PM 93.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_435ec724_00057bcf 10/25/2005 7:00 PM 139.30 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_43616140_000501bd 10/27/2005 6:22 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_4367f832_000c65d4 11/1/2005 6:20 PM 3.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_436950c4_000d59f8 11/2/2005 6:50 PM 18.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_436995b4_00077ec7 11/2/2005 11:44 PM 18 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_436a9e3f_000aba95 11/3/2005 6:33 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026a6_436bd821_0002dc6c 11/4/2005 4:52 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026b1_436ac853_0004c4b4 11/3/2005 9:32 PM 2.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026ca_435eced7_0002dc6c 10/25/2005 7:33 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026ca_436165a1_0001ab3f 10/27/2005 6:41 PM 240.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026ca_4367fcac_000aba95 11/1/2005 6:39 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026ca_436959f5_000af79e 11/2/2005 7:29 PM 35.91 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026ca_436aaffa_000a4083 11/3/2005 7:48 PM 13.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026ca_436ba2bc_000a4083 11/4/2005 1:04 PM 76.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026ca_436be9fa_0009c671 11/4/2005 6:08 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_4356cdd1_0005b8d8 11/4/2005 10:14 PM 12 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_43584e28_0008583b 10/20/2005 9:10 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_435c2f2d_000baeb9 10/23/2005 7:47 PM 293.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_4367f774_000a037a 11/1/2005 6:17 PM 49.13 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_43695043_000c65d4 11/3/2005 8:20 PM 319 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_43699272_0009e121 11/2/2005 11:34 PM 4.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_436a9c23_00022551 11/3/2005 6:24 PM 97.20 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_436b9b58_000a7d8c 11/4/2005 12:33 PM 60.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000026e9_436bbb7c_000d59f8 11/4/2005 2:50 PM 409 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002725_43680a2d_00040d99 11/3/2005 9:22 PM 289 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002725_436abd4f_0005b8d8 11/3/2005 8:45 PM 61.91 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000027da_436ac925_00016e36 11/3/2005 9:36 PM 2.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000282d_43619348_0007a120 10/31/2005 8:07 PM 32.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000282d_43680b3d_000d59f8 11/1/2005 7:44 PM 30.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000282d_436abe54_0004c4b4 11/3/2005 8:50 PM 36.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002833_435edf76_000a4083 10/25/2005 8:44 PM 81.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002833_43616a80_000487ab 10/27/2005 7:02 PM 95.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002833_43680252_0001ab3f 11/1/2005 7:03 PM 32.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002833_436ab6cd_000c28cb 11/3/2005 8:18 PM 28.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002852_43618182_000ec82e 10/27/2005 8:40 PM 54.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002852_436abd1b_0000f424 11/3/2005 8:44 PM 2.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000288f_435ed392_0003567e 10/25/2005 7:55 PM 195.42 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000288f_436167cb_0005b8d8 10/27/2005 6:50 PM 47.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000288f_4367ff57_000e8b25 11/1/2005 6:51 PM 78.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000288f_436ab32e_00066ff3 11/3/2005 8:02 PM 10.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000288f_436ba58a_000a4083 11/4/2005 1:16 PM 278.73 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000028e2_436ac741_0001312d 11/3/2005 9:28 PM 13.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000293b_43680c41_00089544 11/1/2005 7:45 PM 26.31 KB Hidden from Windows API.
C:\Program Fi
cawitt
Regular Member
 
Posts: 27
Joined: October 17th, 2005, 10:57 pm

Unread postby Kimberly » November 5th, 2005, 1:34 am

Hi Chris, the log did get cut of, are there other entries after the C:\Program Files\Ituadobe\Cache\ lines involving other folders / registry entries ? If yes it's very important that I see them.

The tool below will clean up that rootkit. Follow the instructions very carefully please.

You may want to print out these instructions for reference, since you will have to restart your computer during the fix. You MUST run this tool in Safe Mode or it won't detect anything.

Please download AproposFix from here:
http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post the entire contents of the log.txt file in the aproposfix folder. let me know if you had any difficulties with the tool.

1. The rest of the RR log if it had other entries.
2. Aproposfix log
3. A new rootkit Revealer log

Kim
User avatar
Kimberly
MRU Teacher Emeritus
 
Posts: 3505
Joined: June 15th, 2005, 12:57 am

Unread postby cawitt » November 5th, 2005, 2:34 am

Yep, you're right, it did get cut off. Here's more of the RR log (this will take a few segments):

C:\Program Files\Ituadobe\Cache\0000288f_436ba58a_000a4083 11/4/2005 1:16 PM 278.73 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000028e2_436ac741_0001312d 11/3/2005 9:28 PM 13.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000293b_43680c41_00089544 11/1/2005 7:45 PM 26.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000293b_436ac08a_0008583b 11/4/2005 4:51 PM 24.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002959_436189ba_000e4e1c 10/27/2005 9:15 PM 37.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002959_436abe4d_00007a12 11/3/2005 8:50 PM 77.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000029d8_4361838c_000a4083 10/27/2005 8:49 PM 4.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000029d8_43680ace_000baeb9 11/1/2005 7:39 PM 84.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000029d8_436abd89_000b34a7 11/4/2005 1:57 PM 14.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002a38_436ac648_000d59f8 11/3/2005 9:24 PM 8.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b00_4358629a_000a4083 10/20/2005 10:38 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b00_43617c00_0008583b 10/27/2005 8:16 PM 60.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b00_436804d8_0001e848 11/1/2005 7:14 PM 4.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b00_436ab927_000b34a7 11/3/2005 8:28 PM 68.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b0c_435edfb6_000baeb9 10/25/2005 8:45 PM 212.89 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b0c_436175e7_000c65d4 10/27/2005 7:52 PM 167.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b0c_436802ba_0003d090 11/1/2005 7:05 PM 24.83 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002b0c_436ab72c_000baeb9 11/3/2005 8:19 PM 63.89 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ba5_436ac73d_000ca2dd 11/3/2005 9:28 PM 14.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c3b_435ecd2e_000487ab 10/25/2005 7:26 PM 50.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c3b_4367fc83_0007270e 11/1/2005 6:38 PM 80.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c3b_43695925_00003d09 11/2/2005 7:26 PM 12.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c3b_436aae27_00089544 11/3/2005 7:41 PM 107.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c49_435ecf9c_00081b32 11/3/2005 6:38 PM 42.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c49_4367fef2_000a4083 11/1/2005 6:49 PM 62.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c49_436ab32b_000e8b25 11/3/2005 8:02 PM 50.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002c49_436ba576_0002dc6c 11/4/2005 1:16 PM 232.08 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_4356cd08_000ec82e 10/19/2005 5:47 PM 29.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_435849d5_000e4e1c 10/20/2005 8:52 PM 82.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_435c02af_000cdfe6 10/23/2005 4:37 PM 82.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_435ec29f_0001312d 10/25/2005 6:47 PM 344.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_4367f756_0007de29 11/1/2005 6:16 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_43699268_0003712e 11/2/2005 11:30 PM 146 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_436a9c04_00031975 11/3/2005 6:23 PM 96.58 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cd6_436bbb67_0000f424 11/4/2005 2:49 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002cf7_436808a3_000e4e1c 11/1/2005 7:30 PM 4.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_435bd497_0006ea05 10/23/2005 1:21 PM 85.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_435ec5f6_0007de29 10/25/2005 6:55 PM 59.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_4361609f_00016e36 10/27/2005 6:19 PM 4.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_4367f827_000d9701 11/1/2005 6:20 PM 31.46 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_43695079_000baeb9 11/2/2005 6:49 PM 2.99 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_43699376_00064d9a 11/2/2005 11:35 PM 6.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_436a9e33_000b34a7 11/3/2005 6:33 PM 232.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002d12_436b9bf2_000d1cef 11/4/2005 12:35 PM 92.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002db5_436ac54b_000c65d4 11/3/2005 9:21 PM 11.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002e40_435eccfb_0005b8d8 10/25/2005 7:25 PM 48.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002e40_43616474_000ca2dd 10/27/2005 6:41 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002e40_4367fc06_000bebc2 11/1/2005 6:36 PM 3.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002e40_436aadac_000e8b25 11/3/2005 7:39 PM 146.30 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002e40_436be8ae_00029f63 11/4/2005 6:03 PM 221.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_43584e28_000dd40a 10/20/2005 9:10 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_435bd473_000d59f8 10/23/2005 1:20 PM 4.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_43615e76_0006ea05 10/27/2005 6:10 PM 61.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_4367f790_00076417 11/1/2005 6:17 PM 24.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_43695044_0006ea05 11/2/2005 6:48 PM 2.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_4369927c_000b124e 11/2/2005 11:34 PM 17.49 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_436b9b5b_00090f56 11/4/2005 1:04 PM 95.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002ea6_436bbc24_000b34a7 11/4/2005 2:53 PM 213.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002f14_435ecf6c_0008583b 10/25/2005 7:35 PM 36.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002f14_436166c1_0000f424 10/27/2005 6:46 PM 47.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002f14_436ab0f5_0003d090 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002f14_436ba50b_000d59f8 11/4/2005 1:14 PM 5.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002fe7_436ac5c6_000d9701 11/3/2005 9:21 PM 6.58 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002fff_435ed340_0005b8d8 10/25/2005 8:04 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002fff_436167ad_000d9701 10/27/2005 6:50 PM 47.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002fff_436ab32e_0001ab3f 11/3/2005 8:02 PM 5.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00002fff_436ba579_0002dc6c 11/4/2005 1:16 PM 211.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003004_43617cd7_00098968 10/27/2005 8:20 PM 1.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003004_4368070c_00016e36 11/1/2005 7:23 PM 15.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003004_436abb2f_00094c5f 11/3/2005 8:36 PM 11.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000301c_435ec994_000d59f8 10/25/2005 7:11 PM 27.89 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000301c_4367f876_000bebc2 11/1/2005 6:21 PM 5.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000301c_4369559a_0003567e 11/2/2005 7:11 PM 9.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000301c_436a9f9f_00053ec6 11/3/2005 6:39 PM 28.26 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000301c_436b9df1_0001e848 11/4/2005 12:44 PM 70.84 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000301c_436bdec2_00022551 11/4/2005 5:22 PM 1.08 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_435bd47f_000501bd 10/23/2005 1:20 PM 93.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_435ec4fe_000e4e1c 10/25/2005 6:51 PM 88.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_43615f91_00039387 10/27/2005 6:15 PM 227.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_4367f7cd_00076417 11/3/2005 6:32 PM 5.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_43695055_000cdfe6 11/2/2005 6:48 PM 2.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_43699332_00061091 11/2/2005 11:33 PM 14.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_436a9c71_0007a120 11/3/2005 6:25 PM 205.49 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000305e_436bbe6b_00094c5f 11/4/2005 3:02 PM 10.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003087_436ac2d2_000ec82e 11/3/2005 9:09 PM 1.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000030a7_436ac535_0003567e 11/3/2005 9:19 PM 7.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000314f_435ecc5c_000d1cef 10/25/2005 7:22 PM 59.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000314f_43616466_000b71b0 11/1/2005 6:46 PM 24.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000314f_4367fbc2_0000b71b 11/1/2005 7:03 PM 35.90 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000314f_436aad64_000af79e 11/3/2005 7:37 PM 145.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000314f_436b9fe5_0003d090 11/4/2005 12:52 PM 90.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000314f_436be89a_000e8b25 11/4/2005 6:02 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000323b_435ec8d9_00057bcf 10/25/2005 7:07 PM 52.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000323b_436162a0_00053ec6 10/27/2005 6:28 PM 78.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000323b_4367f86f_0002dc6c 11/1/2005 6:21 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000323b_436a9f6f_000bebc2 11/3/2005 6:38 PM 49.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000323b_436b9ca6_000632ea 11/4/2005 12:38 PM 16.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000032e6_435ed56a_00089544 10/25/2005 8:01 PM 237.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000032e6_43680026_00098968 11/1/2005 7:03 PM 37.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000032e6_436ab4b5_0001e848 11/3/2005 8:09 PM 4.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000032e6_436ba61c_0005f5e1 11/4/2005 1:19 PM 190.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000032e7_436acabe_000d59f8 11/3/2005 9:43 PM 2.64 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003382_436ac798_0007de29 11/3/2005 9:29 PM 14.35 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000033ea_435ecf3d_000ec82e 10/25/2005 7:35 PM 207.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000033ea_436166a5_000af79e 10/27/2005 6:45 PM 24.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000033ea_4367fd9f_000d1cef 11/1/2005 6:44 PM 9.85 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000033ea_43695a78_0005b8d8 11/2/2005 7:31 PM 2.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000033ea_436ab096_00076417 11/3/2005 7:51 PM 23.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000033ea_436ba4dd_000bebc2 11/4/2005 1:13 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000033ea_436beaea_000d59f8 11/4/2005 6:12 PM 211.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003459_4361897e_00003d09 10/27/2005 9:14 PM 82.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003459_43680b08_00081b32 11/1/2005 7:40 PM 85.46 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003459_436abe0c_00053ec6 11/3/2005 8:49 PM 6.64 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003492_4368052f_00003d09 11/1/2005 7:15 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003492_436abaa4_000d1cef 11/3/2005 8:34 PM 139.32 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000366b_435ecd13_00040d99 10/25/2005 7:25 PM 49.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000366b_43616476_0003567e 10/27/2005 6:36 PM 82.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000366b_436958c8_0008d24d 11/2/2005 7:24 PM 15.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000366b_436aadd3_000d59f8 11/3/2005 7:42 PM 154.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000366b_436b9ffe_000c28cb 11/4/2005 12:53 PM 4.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000366b_436be8b8_000af79e 11/4/2005 6:03 PM 188.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000368e_435ecf84_000a7d8c 10/25/2005 7:36 PM 230.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000368e_43616769_000632ea 10/27/2005 6:48 PM 156.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000368e_4367fec3_0007a120 11/1/2005 6:49 PM 102.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000368e_436ab10c_0003567e 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003699_435eced8_0000b71b 10/25/2005 7:33 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003699_436165a7_000a037a 10/27/2005 6:41 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003699_4367fcb6_00076417 11/1/2005 6:43 PM 148.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003699_436959fb_00044aa2 11/2/2005 7:29 PM 23.23 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003699_436aaffa_000dd40a 11/3/2005 7:48 PM 1.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003699_436ba2c1_000c65d4 11/4/2005 1:04 PM 85.91 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003699_436be9fa_000baeb9 11/4/2005 6:08 PM 8.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000036a1_436aca42_00089544 11/3/2005 9:41 PM 8.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000036c2_436ac7ec_000d9701 11/3/2005 9:31 PM 4.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000037e5_43617834_000487ab 10/27/2005 8:00 PM 96.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000037e5_43680497_000dd40a 11/1/2005 7:13 PM 233.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000037e5_436ab8d1_0006ea05 11/3/2005 8:26 PM 45.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000037e5_436baa0c_000d1cef 11/4/2005 1:35 PM 22.41 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000037e6_43680494_00003d09 11/1/2005 7:13 PM 228.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000037e6_436ab8b1_0009c671 11/3/2005 8:27 PM 141.58 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000037e6_436ba9c6_0006ea05 11/4/2005 1:34 PM 13.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003807_435862c6_0006ea05 10/20/2005 10:38 PM 745.91 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003807_43680524_000e1113 11/1/2005 7:15 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003807_436ab94d_00053ec6 11/3/2005 8:29 PM 78.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000390c_43615e98_00081b32 10/27/2005 6:11 PM 131.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000390c_4367f7a9_000f0537 11/1/2005 6:18 PM 8.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000390c_43695051_0007a120 11/2/2005 6:48 PM 2.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000390c_436992eb_000741be 11/2/2005 11:32 PM 11.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000390c_436a9c69_00039387 11/3/2005 6:25 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000390c_436b9b9f_0006acfc 11/4/2005 12:34 PM 61.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000390c_436bbc33_00044aa2 11/4/2005 2:53 PM 5.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003960_4361897d_00076417 10/27/2005 9:14 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003960_43680afe_000e1113 11/1/2005 7:40 PM 55.83 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003960_436abe09_00066ff3 11/3/2005 8:48 PM 11.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_4356d1a2_000d9701 10/19/2005 6:07 PM 2.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_435bd48e_000bebc2 10/23/2005 1:21 PM 3.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_435ec5cd_000d9701 10/25/2005 6:54 PM 46.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_4361609e_0008d24d 10/27/2005 6:19 PM 230.08 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_43695078_0001312d 11/2/2005 6:49 PM 3.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_436a9e23_00000000 11/3/2005 6:32 PM 235.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_436b9bd4_00098968 11/4/2005 12:35 PM 4.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039b3_436bc0aa_000ca2dd 11/4/2005 3:12 PM 161 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039ce_43680560_00094c5f 11/1/2005 7:16 PM 344 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000039ce_436abac7_000d59f8 11/3/2005 8:35 PM 56.78 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a2d_435eee1a_00099aa1 10/25/2005 9:46 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a2d_43617736_0007a120 10/27/2005 7:56 PM 4.84 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a2d_43680481_00089544 11/1/2005 7:12 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a2d_436ab83f_000501bd 11/3/2005 8:25 PM 13.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a2d_436ba864_0008583b 11/4/2005 1:28 PM 17.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a61_435ed3a8_000ca2dd 10/25/2005 7:54 PM 167.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a61_436167dd_0007de29 10/27/2005 7:00 PM 53.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a61_4367ff62_00044aa2 11/1/2005 6:51 PM 80.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a61_436ab341_000d1cef 11/3/2005 8:02 PM 19.12 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a61_436ba5f4_0000b71b 11/4/2005 1:18 PM 120.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a8d_435862b3_00081b32 10/23/2005 7:11 PM 2.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a8d_43617c02_000a4083 10/27/2005 8:16 PM 344 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a8d_436804e2_000f0537 11/1/2005 7:14 PM 4.88 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a8d_436ab932_000aba95 11/3/2005 8:28 PM 37.22 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a9e_4361634f_00057bcf 10/27/2005 6:31 PM 176.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a9e_4367fb05_000af79e 11/1/2005 6:32 PM 73.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a9e_4369587a_0005b8d8 11/2/2005 7:23 PM 123.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a9e_436aac79_0005b8d8 11/3/2005 7:41 PM 102.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a9e_436b9f53_000af79e 11/4/2005 12:50 PM 599 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003a9e_436be87a_0005f5e1 11/4/2005 6:02 PM 236.14 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b25_435bd4e0_000cdfe6 10/23/2005 1:22 PM 4.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b25_435ec7b5_00016e36 10/25/2005 7:03 PM 163.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b25_436161d8_000c65d4 10/27/2005 6:25 PM 4.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b25_4367f849_0002dc6c 11/1/2005 6:20 PM 3.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b25_43695421_00053ec6 11/2/2005 7:04 PM 52.22 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b25_436a9ed3_0004c4b4 11/3/2005 6:35 PM 229.64 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b25_436bd841_00003d09 11/4/2005 4:53 PM 265.22 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b97_43680b14_00098968 11/1/2005 7:40 PM 85.46 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003b97_436abe1c_0006acfc 11/3/2005 8:49 PM 6.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bb1_43680561_0002dc6c 11/1/2005 7:16 PM 335 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bb1_436abacc_00003d09 11/3/2005 8:35 PM 56.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bf6_435ecb81_00053ec6 10/25/2005 7:19 PM 51.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bf6_4367fae4_000dd40a 11/1/2005 6:31 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bf6_43695873_00031975 11/2/2005 7:23 PM 62.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bf6_436aac75_000487ab 11/3/2005 7:33 PM 145.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bf6_436b9e3e_000e8b25 11/4/2005 12:45 PM 4.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003bf6_436be877_00066ff3 11/4/2005 6:02 PM 92.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003c61_435ed2fc_000e1113 10/25/2005 8:03 PM 51.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003c61_436167a7_0005f5e1 10/27/2005 6:49 PM 47.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003c61_4367ff01_00057bcf 11/1/2005 6:49 PM 102.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003c61_436ab32d_000d59f8 11/3/2005 8:02 PM 1.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003c61_436ba576_00089544 11/4/2005 1:16 PM 415 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd5_435ecf2f_0004c4b4 10/25/2005 7:34 PM 232.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd5_43616683_00090f56 10/27/2005 6:45 PM 151.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd5_43695a71_00039387 11/2/2005 7:31 PM 2.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd5_436ab032_00044aa2 11/3/2005 7:49 PM 18.46 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd5_436ba4d3_00089544 11/4/2005 1:13 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd5_436bea59_0002dc6c 11/4/2005 6:10 PM 191.84 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd6_435ecf60_00094c5f 10/25/2005 7:35 PM 10.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd6_436166bc_00016e36 10/27/2005 6:46 PM 398 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd6_4367fe4d_000ec82e 11/1/2005 6:46 PM 3.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd6_436ab0f0_00098968 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003cd6_436ba502_000a7d8c 11/4/2005 1:14 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_4356cd06_000ec82e 11/2/2005 11:44 PM 199 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_435849d5_000501bd 10/20/2005 8:52 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_435c02af_00031975 10/23/2005 4:37 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_435ec275_0006ea05 10/25/2005 6:40 PM 23.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_4366d4ca_000e8b25 10/31/2005 9:36 PM 244.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_4367f755_0001e848 11/1/2005 6:16 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_4368256e_00040d99 11/1/2005 9:33 PM 2.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_436835ee_000501bd 11/1/2005 10:43 PM 2.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_43694131_00003d09 11/2/2005 5:45 PM 56.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_43699265_00051c6d 11/2/2005 11:30 PM 3.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_436a9c02_0004c4b4 11/3/2005 6:23 PM 590 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003d6c_436bbb65_000cdfe6 11/4/2005 2:49 PM 180.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003e12_435eca97_00044aa2 10/25/2005 7:15 PM 112.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003e12_4367fad9_00098968 11/1/2005 6:31 PM 220.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003e12_436aac60_0007a120 11/3/2005 7:33 PM 112.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003e12_436b9e2c_0001e848 11/4/2005 1:04 PM 96.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003e12_436bdf39_000d59f8 11/4/2005 5:22 PM 60.88 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ee9_436ac462_0007de29 11/3/2005 9:16 PM 1.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ef6_435ecd41_0001e848 10/25/2005 7:26 PM 48.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ef6_4361653d_0003567e 10/27/2005 6:39 PM 5.49 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ef6_4367fc8d_000aba95 11/1/2005 6:38 PM 427 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ef6_4369596c_00044aa2 11/2/2005 7:27 PM 24.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ef6_436aaec5_00090f56 11/3/2005 7:45 PM 79.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ef6_436ba2a4_0008583b 11/4/2005 1:04 PM 61.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003ef6_436be9bb_00098968 11/4/2005 6:07 PM 237.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003f0b_436ac2ca_00031975 11/3/2005 9:09 PM 5.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00003f4a_436abbf6_0001ab3f 11/3/2005 8:40 PM 29.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000401d_435ed5de_0005b8d8 10/25/2005 8:03 PM 133.20 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000401d_436168e1_00044aa2 10/27/2005 6:55 PM 50.83 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000401d_436ab58d_0005f5e1 11/3/2005 8:12 PM 6.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000401d_436ba61c_000ca2dd 11/4/2005 1:19 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004027_43680b33_000c28cb 11/1/2005 7:44 PM 55.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004027_436abe2f_00089544 11/3/2005 8:49 PM 5.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004080_435ecf35_000aba95 10/25/2005 7:35 PM 226.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004080_43616697_00039387 10/27/2005 6:45 PM 35.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004080_4367fd92_0007270e 11/1/2005 6:43 PM 15.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004080_43695a74_000f0537 11/2/2005 7:31 PM 2.98 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004080_436ab05b_00040d99 11/3/2005 7:50 PM 15.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004080_436ba4d7_000b71b0 11/4/2005 1:13 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004080_436beae8_00076417 11/4/2005 6:12 PM 232.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004087_4358623e_000dd40a 11/1/2005 10:49 PM 18.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004087_43617866_000501bd 10/27/2005 8:01 PM 88.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004087_436804b8_0007de29 11/1/2005 7:13 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004087_436ab8f0_0001312d 11/3/2005 8:27 PM 45.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004087_436baa69_000501bd 11/4/2005 1:37 PM 5.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000409d_435eceb9_0005b8d8 10/25/2005 7:32 PM 169.88 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000409d_4361655e_0008d24d 10/27/2005 6:40 PM 54.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000409d_4367fca6_00098968 11/1/2005 6:39 PM 392 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000409d_4369599f_00022551 11/2/2005 7:28 PM 29.94 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000409d_436aaf13_00090f56 11/3/2005 7:45 PM 29.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000409d_436be9cb_00098968 11/4/2005 6:07 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000040a5_4368158b_000baeb9 11/2/2005 7:09 PM 44.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000040a5_436ac09e_0007270e 11/3/2005 8:59 PM 48.95 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000041bb_43584e28_0005f5e1 10/20/2005 9:10 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000041bb_435c2c79_0005b8d8 11/1/2005 10:48 PM 494.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000041bb_43695042_000dd40a 11/3/2005 8:20 PM 35.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000041bb_43699272_000835e2 11/2/2005 11:34 PM 2.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000041bb_436a9c1c_0006acfc 11/3/2005 6:24 PM 81.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000041bb_436b99cb_00016e36 11/4/2005 12:50 PM 95.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000041bb_436bbb7c_000a7d8c 11/4/2005 2:50 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000422d_435ecf78_000501bd 10/25/2005 7:36 PM 417.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000422d_43616761_000b71b0 10/27/2005 6:48 PM 26.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000422d_4367fea1_0008d24d 11/1/2005 6:48 PM 98.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000422d_436ab103_000e4e1c 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000422d_436ba515_0005b8d8 11/4/2005 1:14 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004230_435ecd25_000d59f8 10/25/2005 7:26 PM 50.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004230_4367fc53_000dd40a 11/1/2005 6:37 PM 35.03 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004230_43695915_000e1113 11/2/2005 7:25 PM 19.22 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004230_436aade5_00003d09 11/3/2005 7:40 PM 98.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004230_436ba00f_0006ea05 11/4/2005 12:53 PM 4.73 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004230_436be92a_000e1113 11/4/2005 6:05 PM 237.83 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_4356d1bc_0007270e 10/19/2005 6:07 PM 2.03 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_435bd4a6_000cdfe6 10/23/2005 1:21 PM 72.23 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_435ec70f_0008d24d 10/25/2005 7:00 PM 166.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_436160de_0000b71b 10/27/2005 6:26 PM 15.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_4367f832_00081b32 11/1/2005 6:20 PM 3.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_436950a6_00066ff3 11/2/2005 6:54 PM 91.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_436a9e3f_0000f424 11/3/2005 6:33 PM 229.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000428b_436bd81f_000c28cb 11/4/2005 4:52 PM 184.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004325_43680b91_000a7d8c 11/1/2005 7:42 PM 26.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004325_436abfbc_0000b71b 11/3/2005 8:56 PM 4.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004328_436ac9e7_000a4083 11/3/2005 9:39 PM 9.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004346_436ae6dc_000bebc2 11/3/2005 11:43 PM 21.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004402_435ed622_00040d99 10/25/2005 8:04 PM 15.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004402_436169e2_000e4e1c 10/27/2005 7:00 PM 108.99 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004402_436ab674_00066ff3 11/3/2005 8:16 PM 7.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004402_436ba62b_00098968 11/4/2005 1:19 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000440d_435ec514_0001312d 10/25/2005 6:51 PM 87.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000440d_43615f91_00098968 10/27/2005 6:15 PM 4.58 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000440d_4367f80f_00044aa2 11/1/2005 6:19 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000440d_43695056_000a7d8c 11/2/2005 6:48 PM 2.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000440d_43699333_0006c7ac 11/2/2005 11:33 PM 22.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000440d_436a9c71_000e1113 11/3/2005 6:25 PM 5.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000440d_436bc0a8_0009c671 11/4/2005 3:12 PM 1.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000441d_436ac3d4_000d59f8 11/3/2005 9:13 PM 2.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000442b_435860d2_00053ec6 10/20/2005 10:30 PM 18.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000442b_43617858_00039387 10/27/2005 8:16 PM 96.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000442b_436804b3_0008583b 11/1/2005 7:13 PM 226.13 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000442b_436ab8e6_000d1cef 11/3/2005 8:27 PM 45.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000442b_436baa22_000632ea 11/4/2005 1:36 PM 15.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004509_435bd4db_000af79e 10/23/2005 1:22 PM 5.41 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004509_43616191_000b34a7 10/27/2005 6:24 PM 5.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004509_4367f83a_000f0537 11/1/2005 6:20 PM 564 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004509_436951bd_000e1113 11/2/2005 6:54 PM 3.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004509_436a9ecb_0000f424 11/3/2005 6:35 PM 234.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004509_436bd82e_000b34a7 11/4/2005 4:52 PM 410 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000456d_436ac9d9_0005b8d8 11/3/2005 9:39 PM 10.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000458f_43617740_000a7d8c 11/1/2005 7:24 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000458f_43680488_00016e36 11/1/2005 7:12 PM 219.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000458f_436ab890_00081b32 11/3/2005 8:25 PM 58.32 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000458f_436ba9b2_000c65d4 11/4/2005 1:34 PM 13.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000045c5_4361897c_0007a120 10/27/2005 9:14 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000045c5_43680af9_000d9701 11/1/2005 7:40 PM 30.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000045c5_436abe02_00040d99 11/3/2005 8:48 PM 19.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004626_436ac873_0003d090 11/3/2005 9:33 PM 2.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004657_435ecf99_000bebc2 11/4/2005 6:17 PM 40.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004657_43616795_000a4083 10/27/2005 6:49 PM 48.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004657_436ab253_0008583b 11/3/2005 7:58 PM 11.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004657_436ba553_00076417 11/4/2005 1:15 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000468c_436ac2b5_00098968 11/3/2005 9:40 PM 1.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000046c2_436ac542_000e1113 11/3/2005 9:19 PM 2.13 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000046cf_435ee355_00056e51 10/25/2005 9:00 PM 209.91 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000046cf_43617735_000b71b0 10/27/2005 7:56 PM 529 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000046cf_4368047a_0001ab3f 11/1/2005 7:12 PM 200.38 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000046cf_436ab7d0_00057bcf 11/3/2005 8:26 PM 101.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000046cf_436ba84f_000c28cb 11/4/2005 1:28 PM 10.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000470e_43617cd8_00029f63 10/27/2005 8:20 PM 26.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000470e_4368076f_00040d99 11/1/2005 7:25 PM 24.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000470e_436abb79_00044aa2 11/3/2005 8:38 PM 17.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_4356cd01_0007a120 10/19/2005 5:47 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_435849cb_00016e36 10/20/2005 8:52 PM 11.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_435bd444_00076417 10/27/2005 6:07 PM 788.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_435c021e_000ca2dd 11/3/2005 11:18 PM 806.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_435d7fea_0001ab3f 10/24/2005 7:44 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_43603b2f_00016e36 10/26/2005 9:27 PM 2 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_43615dbe_00053ec6 10/27/2005 6:07 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_4366bb3d_000ca2dd 10/31/2005 7:47 PM 298 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_4366cb98_000f0537 10/31/2005 8:57 PM 8.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_4367f732_000b34a7 11/1/2005 6:16 PM 61.22 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_4368248f_00076417 11/1/2005 10:43 PM 11.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_436834af_0003567e 11/1/2005 10:38 PM 583.08 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_436940f4_0000b71b 11/2/2005 5:43 PM 17.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_43697169_0007de29 11/2/2005 9:09 PM 403 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_436a9bff_000bebc2 11/3/2005 6:23 PM 61.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_436b9947_00029f63 11/4/2005 12:24 PM 61.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004823_436bb2de_0006ea05 11/4/2005 3:12 PM 22.85 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000486a_43617cd6_000c65d4 10/27/2005 8:20 PM 37.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000486a_43680577_0008583b 11/1/2005 7:16 PM 426 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000486a_436abb0f_00040d99 11/3/2005 8:36 PM 28.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000489c_435ed439_000cdfe6 10/25/2005 7:56 PM 163.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000489c_4361683a_00089544 10/27/2005 6:52 PM 102.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000489c_43680000_000d59f8 11/1/2005 7:02 PM 42.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000489c_436ab38e_0006ea05 11/3/2005 8:04 PM 5.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000489c_436ba602_00076417 11/4/2005 1:18 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000048cc_436166af_0001e848 10/27/2005 6:45 PM 53.08 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000048cc_436ab0bb_0008583b 11/3/2005 7:56 PM 13.66 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000048cc_436ba4fa_00016e36 11/4/2005 1:14 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000048cc_436beaee_0002625a 11/4/2005 6:12 PM 270.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000048db_43618186_000e8b25 10/27/2005 8:40 PM 23.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000048db_43680a28_00076417 11/1/2005 7:36 PM 60.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000048db_436abd1f_00007a12 11/3/2005 8:45 PM 1.78 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000491c_435bd488_000d9701 10/23/2005 1:20 PM 96.47 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000491c_435ec550_000e4e1c 10/25/2005 6:52 PM 50.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000491c_43616033_0007a120 10/27/2005 6:18 PM 225.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000491c_4367f811_000b34a7 11/1/2005 6:19 PM 833.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000491c_43695057_000b34a7 11/2/2005 6:48 PM 2.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000491c_436a9c72_0000b71b 11/3/2005 6:25 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000491c_436bc0a9_0001ab3f 11/4/2005 3:12 PM 157 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004944_435eccf9_000a7d8c 10/25/2005 7:25 PM 20.20 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004944_43616472_000501bd 11/1/2005 6:47 PM 114.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004944_436aad7f_0003567e 11/3/2005 7:38 PM 128.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004944_436be8a2_0006ea05 11/4/2005 6:02 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000494a_435ed612_00044aa2 10/25/2005 8:05 PM 143.60 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000494a_436169bc_0008583b 10/27/2005 7:00 PM 191.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000494a_4368007b_00040d99 11/1/2005 6:55 PM 30.73 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000494a_436ab62b_000d59f8 11/3/2005 8:15 PM 2.64 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000494a_436ba622_000baeb9 11/4/2005 1:19 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004963_436ac7f2_0009c671 11/3/2005 9:31 PM 14.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000049bb_436abc8f_0005f5e1 11/3/2005 8:42 PM 59.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000049f7_435860b9_00039387 10/24/2005 7:43 PM 6.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000049f7_43617855_0001312d 10/27/2005 8:01 PM 131.15 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000049f7_43680498_00098968 11/1/2005 7:13 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000049f7_436ab8e0_000f0537 11/3/2005 8:26 PM 46.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000049f7_436baa18_0006ea05 11/4/2005 1:36 PM 15.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004a80_435ecf01_000a4083 10/25/2005 7:34 PM 222.76 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004a80_43616619_000c28cb 10/27/2005 6:44 PM 377.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004a80_4367fd1d_000487ab 11/1/2005 7:08 PM 45.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004a80_43695a5d_000af79e 11/3/2005 6:24 PM 17.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004a80_436ab01b_000dd40a 11/3/2005 7:49 PM 15.88 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004a80_436ba2ca_00081b32 11/4/2005 5:22 PM 302 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004a80_436bea50_000e8b25 11/4/2005 6:10 PM 409 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ad4_43680894_000d9701 11/1/2005 7:30 PM 56.87 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_4356cd06_00000000 11/2/2005 11:44 PM 199 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_435849d5_00003d09 11/2/2005 11:30 PM 12.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_435c02ae_00044aa2 10/23/2005 4:37 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_435d92c5_000cdfe6 10/24/2005 9:04 PM 11.17 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_435ec25a_00016e36 10/25/2005 6:40 PM 20.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_4366bb81_000f0537 10/31/2005 7:49 PM 35.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_4366d4c0_000a037a 10/31/2005 9:36 PM 576.35 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_4367f74e_00039387 11/1/2005 6:16 PM 97.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_4368256c_000d1cef 11/1/2005 10:43 PM 8.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_436835ee_00044aa2 11/1/2005 10:43 PM 4.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_43694123_0007de29 11/2/2005 5:43 PM 18.93 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_4369717f_000e4e1c 11/2/2005 9:10 PM 6.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ae1_436bbb34_00000000 11/4/2005 2:49 PM 22.03 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004b40_435eca2a_00076417 10/25/2005 7:13 PM 38.02 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004b40_43616313_000a4083 10/27/2005 6:30 PM 4.35 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004b40_4367fac3_00031975 11/1/2005 6:31 PM 47 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004b40_436aac3e_0002625a 11/3/2005 7:33 PM 148.42 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004b40_436bdec5_0007270e 11/4/2005 5:22 PM 711 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004c66_436ac6a2_0005b8d8 11/3/2005 9:25 PM 12.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004c85_43680561_00031975 11/1/2005 7:16 PM 7.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004c85_436abacf_00022551 11/3/2005 8:35 PM 56.63 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cad_435ecc10_00003d09 10/25/2005 8:41 PM 27.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cad_43616463_00094c5f 10/27/2005 6:54 PM 53.16 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cad_4367fbba_0001e848 11/1/2005 6:36 PM 42.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cad_436aad63_000aba95 11/3/2005 7:37 PM 102.50 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cad_436b9fdf_00040d99 11/4/2005 12:52 PM 4.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cad_436be89a_00044aa2 11/4/2005 6:02 PM 220.96 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cd4_435ee20c_000a95b0 10/25/2005 8:55 PM 414 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cd4_43617734_00040d99 10/27/2005 7:56 PM 79.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cd4_43680342_00076417 11/1/2005 7:07 PM 33.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cd4_436ab79b_000a037a 11/3/2005 8:23 PM 73.22 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004cd4_436ba6aa_00003d09 11/4/2005 1:21 PM 32.91 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_435bd489_000baeb9 10/23/2005 1:20 PM 254 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_435ec55e_0004c4b4 10/25/2005 8:41 PM 69.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_43616036_0006acfc 10/27/2005 6:18 PM 205.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_4367f813_00057bcf 11/1/2005 6:19 PM 36.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_43695058_0009c671 11/2/2005 6:48 PM 2.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_43699350_00042849 11/2/2005 11:34 PM 15.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_436a9c8d_0002dc6c 11/3/2005 6:26 PM 149.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d06_436bc0aa_0000b71b 11/4/2005 3:12 PM 2.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d54_43617cc6_000d1cef 10/27/2005 8:20 PM 95.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d54_4368055f_00090f56 11/1/2005 7:16 PM 914 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d54_436ababd_000cdfe6 11/3/2005 8:34 PM 56.84 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d67_43617cfe_00090f56 10/27/2005 8:21 PM 73.90 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d67_43680828_00029f63 11/1/2005 7:28 PM 21.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d67_436abba3_00089544 11/3/2005 8:38 PM 11.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004d9a_436ac3e2_0001ab3f 11/3/2005 9:13 PM 14.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004db7_435bd48a_000a4083 11/3/2005 6:24 PM 12.42 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004db7_43616044_0008d24d 10/27/2005 6:18 PM 15.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004db7_4369506b_0005b8d8 11/2/2005 6:53 PM 69.72 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004db7_436a9c8d_00089544 11/3/2005 6:26 PM 5.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004db7_436bc0aa_00053ec6 11/4/2005 3:12 PM 229 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_4356d1a3_000632ea 10/19/2005 6:07 PM 1.71 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_435bd49a_000af79e 10/23/2005 1:21 PM 3.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_435ec62e_00031975 10/25/2005 7:20 PM 28.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_436160b9_00081b32 10/27/2005 6:25 PM 6.54 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_4367f829_0000f424 11/1/2005 6:20 PM 3.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_4369508b_0001e848 11/2/2005 6:53 PM 16.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_436995ac_000b124e 11/2/2005 11:44 PM 5.80 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004dc8_436a9e34_00066ff3 11/3/2005 6:33 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004df2_435ecc8c_0008d24d 10/25/2005 7:23 PM 47.41 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004df2_4361646d_000a4083 11/1/2005 6:46 PM 155.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004df2_436aad71_0004c4b4 11/3/2005 7:39 PM 129.58 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004df2_436b9fe5_000b71b0 11/4/2005 12:52 PM 4.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004df2_436be8a1_000d59f8 11/4/2005 6:02 PM 203.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e08_43680ba6_000e4e1c 11/1/2005 7:43 PM 26.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e08_436abfc1_00003d09 11/3/2005 8:56 PM 4.09 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e45_435ec8b3_000ec82e 10/25/2005 7:07 PM 53.29 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e45_43616294_0002dc6c 10/27/2005 6:28 PM 4.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e45_4367f86f_00007a12 11/1/2005 6:21 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e45_43695493_000e4e1c 11/2/2005 7:06 PM 214.43 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e45_436a9f04_00003d09 11/3/2005 6:36 PM 418 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e45_436b9ca6_00007a12 11/4/2005 12:38 PM 344 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e45_436bd947_000d1cef 11/4/2005 4:57 PM 399 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e55_436ac626_000e8b25 11/3/2005 9:23 PM 9.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e57_436808c2_000e4e1c 11/1/2005 7:30 PM 19.49 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004e57_436abc2a_000e4e1c 11/3/2005 8:40 PM 7.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004eae_436abcb2_0007270e 11/3/2005 8:43 PM 22.55 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ebf_436ac981_0000f424 11/3/2005 9:37 PM 11.07 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004efe_436ac6f3_00000000 11/3/2005 9:26 PM 3.48 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004f68_436808c5_000baeb9 11/1/2005 7:31 PM 19.46 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004f68_436abc34_000af79e 11/3/2005 8:41 PM 9.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004fc0_436ac453_00003d09 11/3/2005 9:15 PM 14.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ff8_43617ccc_0002dc6c 10/27/2005 8:20 PM 95.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ff8_43680573_000af79e 11/1/2005 7:16 PM 819 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00004ff8_436abae6_000e1113 11/3/2005 8:35 PM 56.70 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005005_435862b4_000f0537 10/20/2005 10:38 PM 28.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005005_43617c09_000aba95 10/27/2005 8:16 PM 99.05 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005005_436804e6_00022551 11/1/2005 7:14 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005005_436ab93c_000d9701 11/3/2005 8:28 PM 36.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005039_435ed650_00053ec6 10/25/2005 8:05 PM 15.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005039_43616a14_000ca2dd 10/27/2005 7:00 PM 135.36 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005039_436ab684_000b71b0 11/3/2005 8:16 PM 4.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005039_436ba630_000a7d8c 11/4/2005 1:19 PM 407 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005064_43617cc1_000e4e1c 10/27/2005 8:20 PM 1.68 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005064_43680534_0007a120 11/1/2005 7:15 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005064_436ababa_000ca2dd 11/3/2005 8:34 PM 72.67 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005078_435860d9_0000b71b 10/23/2005 7:13 PM 57.45 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005078_43617858_00098968 10/27/2005 8:01 PM 4.35 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005078_436804b4_0001ab3f 11/1/2005 7:13 PM 405 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005078_436ab8ea_00003d09 11/3/2005 8:27 PM 46.28 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005078_436baa47_0008583b 11/4/2005 1:36 PM 19.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000050bf_436ac565_00066ff3 11/3/2005 9:20 PM 6.78 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000513e_43680561_000a7d8c 11/1/2005 7:16 PM 13.21 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000513e_436abad3_000baeb9 11/3/2005 8:35 PM 56.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000051d1_436ac668_00090f56 11/3/2005 9:24 PM 8.53 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000520b_43680aea_00053ec6 11/1/2005 7:40 PM 85.46 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000520b_436abdbb_000ca2dd 11/3/2005 8:47 PM 11.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000053b1_43680bee_000c65d4 11/1/2005 7:44 PM 26.34 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000053b1_436ac07e_000a037a 11/4/2005 3:11 PM 28.69 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005422_435ecd39_000aba95 10/25/2005 7:26 PM 50.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005422_4367fc8d_0006ea05 11/1/2005 6:38 PM 1.31 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005422_4369596a_00007a12 11/2/2005 7:27 PM 50.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005422_436aaec2_0002625a 11/3/2005 7:47 PM 57.25 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005422_436ba024_000ec82e 11/4/2005 12:53 PM 90.97 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005422_436be981_000f0537 11/4/2005 6:06 PM 408 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000542c_435ed66b_000632ea 10/25/2005 8:06 PM 126.52 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000542c_43616a3f_00016e36 10/27/2005 7:50 PM 104.65 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000542c_43680130_00000000 11/1/2005 6:58 PM 384 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000542c_436ab696_000c65d4 11/3/2005 8:17 PM 6.19 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000542c_436ba632_0004c4b4 11/4/2005 1:19 PM 237.88 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054d6_436ac2b5_000e4e1c 11/3/2005 9:40 PM 557 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054dc_435ecf81_0008d24d 10/25/2005 7:36 PM 224.47 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054dc_43616764_000d1cef 10/27/2005 7:00 PM 114.10 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054dc_4367feb0_000a037a 11/1/2005 6:48 PM 53.18 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054dc_436ab109_000b71b0 11/3/2005 7:57 PM 3.82 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054de_4356d1a0_00057bcf 10/19/2005 6:07 PM 44.81 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054de_435bd48b_0006acfc 10/23/2005 1:20 PM 82.11 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054de_43616099_0001e848 10/27/2005 6:19 PM 5.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054de_43695076_000cdfe6 11/2/2005 6:49 PM 3.03 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054de_436a9d7e_00031975 11/3/2005 6:30 PM 5.44 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054de_436b9bd4_00016e36 11/4/2005 12:35 PM 79.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000054de_436bc0aa_000bebc2 11/4/2005 3:12 PM 208 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005579_43617d29_00089544 10/27/2005 8:21 PM 3.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005579_43680976_000e4e1c 11/1/2005 7:33 PM 6.57 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005579_436abcfe_000dd40a 11/3/2005 8:44 PM 11.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000056ae_435ec99b_000dd40a 10/25/2005 7:11 PM 40.77 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000056ae_4367fab4_00090f56 11/1/2005 6:31 PM 4.58 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000056ae_436955bd_000ec82e 11/2/2005 7:11 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000056ae_436a9fc8_000f0537 11/3/2005 6:39 PM 1.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000056ae_436b9dfc_000c65d4 11/4/2005 12:44 PM 76.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000056ae_436bdec2_000632ea 11/4/2005 5:20 PM 294 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005753_435ecf4a_0007a120 10/25/2005 7:35 PM 30.06 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005753_436166b1_00090f56 10/27/2005 6:45 PM 42.55 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005753_4367fdc8_000b71b0 11/1/2005 6:44 PM 9.39 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005753_436ab0c1_0004c4b4 11/3/2005 7:59 PM 13.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005753_436ba4fe_00029f63 11/4/2005 1:14 PM 342.24 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005753_436bebee_0002dc6c 11/4/2005 6:17 PM 238.64 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005772_435ecee1_00040d99 10/25/2005 7:33 PM 4.59 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005772_436165bd_000a4083 10/27/2005 6:41 PM 250.62 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005772_4367fcdf_0000f424 11/1/2005 6:40 PM 30.33 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005772_43695a1e_000501bd 11/2/2005 7:30 PM 10.56 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005772_436aaffb_00022551 11/3/2005 7:48 PM 564 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005772_436bea10_0008d24d 11/4/2005 6:09 PM 232.04 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000057d3_435eee1c_000b8415 10/25/2005 9:46 PM 82.47 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000057d3_43617740_000a037a 11/1/2005 7:24 PM 0 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000057d3_43680485_00089544 11/1/2005 7:12 PM 404 bytes Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000057d3_436ba9b0_000487ab 11/4/2005 1:34 PM 13.32 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005815_436ac38d_00053ec6 11/3/2005 9:12 PM 1.51 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005876_436abc65_0001e848 11/3/2005 8:41 PM 3.14 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005878_435eca33_0001ab3f 10/25/2005 7:13 PM 53.41 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005878_4361631a_000d1cef 10/27/2005 6:30 PM 95.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005878_4367fac7_00022551 11/1/2005 6:31 PM 214.61 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005878_436aac44_0008d24d 11/3/2005 7:33 PM 115.27 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\00005878_436bdec8_00031975 11/4/2005 5:20 PM 82.40 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000058b0_435eced2_000a7d8c 10/25/2005 7:33 PM 211.37 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000058b0_43616585_000dd40a 10/27/2005 6:40 PM 241.01 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000058b0_4367fcac_0008583b 11/1/2005 6:39 PM 51.00 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000058b0_436959f3_00022551 11/2/2005 7:29 PM 57.79 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000058b0_436aaff7_0001ab3f 11/3/2005 7:48 PM 44.73 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000058b0_436be9fa_0002625a 11/4/2005 6:08 PM 232.74 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\000058c5_436aca97_000aba95 11/3/2005 9:42 PM 5.75 KB Hidden from Windows API.
C:\Program Files\Ituadobe\Cache\0000590e_43586298_000632ea 10/
cawitt
Regular Member
 
Posts: 27
Joined: October 17th, 2005, 10:57 pm
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 271 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware