I followed the instructions above and started the scan through hijackthis.exe.
The program closes seconds into its progress....everytime.
Any help as to what to do next would be fantastic.
Thanks!
Full Version: Followed Instructions Above But...
Lavasoft Support Forums > Archived Topics > Archives: Resolved/Inactive Topics > Resolved/Inactive HijackThis Logs
Hello,Jason86 & Welcome
First make sure you are extracting HijackThis.exe and not trying to run it from
it's zip or rar file/folder.
Unzip HijackThis:
Right-click on the HijackThis zip folder and choose "Extract All".
An extraction wizard window will now open. Click "Next".
In the "Files will be extracted to this directory:" field, type C:\HJT. Then click "Next".
Click "Finish" to show your unzipped/extracted HijackThis folder. Run HijackThis.exe from here, or add a shortcut to your desktop.
--------------
NOTE: Before you run a scan do this for me goto where you installed HijackThis.exe
and rename it to say Cando.exe, now run your scan show me logfile.
Gogo
First make sure you are extracting HijackThis.exe and not trying to run it from
it's zip or rar file/folder.
Unzip HijackThis:
Right-click on the HijackThis zip folder and choose "Extract All".
An extraction wizard window will now open. Click "Next".
In the "Files will be extracted to this directory:" field, type C:\HJT. Then click "Next".
Click "Finish" to show your unzipped/extracted HijackThis folder. Run HijackThis.exe from here, or add a shortcut to your desktop.
--------------
NOTE: Before you run a scan do this for me goto where you installed HijackThis.exe
and rename it to say Cando.exe, now run your scan show me logfile.
Gogo
Hrmmm...
The filename is changed and the instructions were followed as you outlined....
Still the same result.
It closes within seconds of being open.
Regards,
Jason
The filename is changed and the instructions were followed as you outlined....
Still the same result.
It closes within seconds of being open.
Regards,
Jason
Hi,Jason
Feedback are you first extracting HijackThis.exe from it's zip/rar file or folder.???
as I had said above please.
Gogo
Feedback are you first extracting HijackThis.exe from it's zip/rar file or folder.???
as I had said above please.
Gogo
Hi,Jason
Please goto this site here and download the HijackThis Executable
http://www.trendsecure.com/portal/en-US/th...hijackthis.php#
NOTE: This is in beta version
Also
System requirements:
Operating System:
* Microsoft™ Windows™ XP
* Microsoft™ Windows™ 2000
*May require Visual Basic Runtime Libraries available from Microsoft here
Software:
* Microsoft™ Internet Explorer 7.0
* Microsoft™ Internet Explorer 6.0
* Mozilla™ Firefox™ 1.5 or higher
Gogo
Please goto this site here and download the HijackThis Executable
http://www.trendsecure.com/portal/en-US/th...hijackthis.php#
NOTE: This is in beta version
Also
System requirements:
Operating System:
* Microsoft™ Windows™ XP
* Microsoft™ Windows™ 2000
*May require Visual Basic Runtime Libraries available from Microsoft here
Software:
* Microsoft™ Internet Explorer 7.0
* Microsoft™ Internet Explorer 6.0
* Mozilla™ Firefox™ 1.5 or higher
Gogo
Thanks so much for all of your advice so far...
After downloading the executable file from the link that you posted, the function, once it starts scanning, immedietly shuts down as it did with the previous attempts.
I relocated that executable file several times and renamed it several times...but all the same result
Regards,
Jason
After downloading the executable file from the link that you posted, the function, once it starts scanning, immedietly shuts down as it did with the previous attempts.
I relocated that executable file several times and renamed it several times...but all the same result
Regards,
Jason
Hey,Jason86
Hmm odd well let's try running these tools here
Please download SUPERAntiSpyware Home Edition (free version)
Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click Yes.
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining.
Please leave the others unchecked.
Click the Close button to leave the control center screen.
On the main screen, under Scan for Harmful Software click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click Yes.
To retrieve the removal information for me please do the following:
After reboot, double-click the SUPERAntispyware icon on your desktop.
Click Preferences. Click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
It will open in your default text editor (such as Notepad/Wordpad).
Please highlight everything in the notepad, then right-click and choose copy.
Click close and close again to exit the program.
Please paste that information here for me with a new HijackThis log.
-------------
Please download CCleaner (freeware) and save it to your desktop:
*Run the CCleaner installer.
*During installation process, please UNCHECK "Add CCleaner Yahoo! Toolbar".
*Once installed, run CCleaner and click the Windows tab.
*Select the following:
*Check everything under the Internet Explorer section.
*Check everything under the Windows Explorer section.
*Check everything under the System section.
*Check ONLY Old Prefetch data under the Advanced section.
*Then, click the Applications tab:
*UNCHECK everything there.
*Next, click the Options button, then click the Advanced button:
*UNCHECK : "Only delete files in Windows Temp folders older than 48 hours".
*Next, click the Cleaner button, then click the Run Cleaner button (bottom right), then Exit.
CAUTION : Please do NOT use the Issues button. This is a built-in registry cleaner. If you don’t know how to use it, you may cause irreparable damage to your system.
--------------
Then come back here with all logfiles.
Gogo
Hmm odd well let's try running these tools here
Please download SUPERAntiSpyware Home Edition (free version)
Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click Yes.
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining.
Please leave the others unchecked.
Click the Close button to leave the control center screen.
On the main screen, under Scan for Harmful Software click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click Yes.
To retrieve the removal information for me please do the following:
After reboot, double-click the SUPERAntispyware icon on your desktop.
Click Preferences. Click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
It will open in your default text editor (such as Notepad/Wordpad).
Please highlight everything in the notepad, then right-click and choose copy.
Click close and close again to exit the program.
Please paste that information here for me with a new HijackThis log.
-------------
Please download CCleaner (freeware) and save it to your desktop:
*Run the CCleaner installer.
*During installation process, please UNCHECK "Add CCleaner Yahoo! Toolbar".
*Once installed, run CCleaner and click the Windows tab.
*Select the following:
*Check everything under the Internet Explorer section.
*Check everything under the Windows Explorer section.
*Check everything under the System section.
*Check ONLY Old Prefetch data under the Advanced section.
*Then, click the Applications tab:
*UNCHECK everything there.
*Next, click the Options button, then click the Advanced button:
*UNCHECK : "Only delete files in Windows Temp folders older than 48 hours".
*Next, click the Cleaner button, then click the Run Cleaner button (bottom right), then Exit.
CAUTION : Please do NOT use the Issues button. This is a built-in registry cleaner. If you don’t know how to use it, you may cause irreparable damage to your system.
--------------
Then come back here with all logfiles.
Gogo
SUPERAntiSpyware Scan Log
Generated 03/23/2007 at 05:35 AM
Application Version : 3.6.1000
Core Rules Database Version : 3205
Trace Rules Database Version: 1215
Scan type : Complete Scan
Total Scan Time : 03:16:39
Memory items scanned : 335
Memory threats detected : 1
Registry items scanned : 5002
Registry threats detected : 41
File items scanned : 54511
File threats detected : 57
Adware.MyWebSearch
C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\Programmable
C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable
HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\Programmable
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\TypeLib
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\Programmable
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\TypeLib
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKU\S-1-5-21-4025279379-1021817841-4004396944-1007\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE
Kontiki Download Manager Browser Helper Object
HKLM\Software\Classes\CLSID\{029CA12C-89C1-46a7-A3C7-82F2F98635CB}
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\InprocServer32
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\InprocServer32#ThreadingModel
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\ProgID
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\Programmable
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\TypeLib
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\VersionIndependentProgID
C:\PROGRAM FILES\KONTIKI\BIN\BH304181.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029CA12C-89C1-46a7-A3C7-82F2F98635CB}
Adware.Tracking Cookie
C:\Documents and Settings\Jason\Cookies\jason@ctxtad[1].txt
C:\Documents and Settings\Jason\Cookies\jason@toplist[1].txt
C:\Documents and Settings\Jason\Cookies\jason@fastclick[2].txt
C:\Documents and Settings\Jason\Cookies\jason@burstnet[2].txt
C:\Documents and Settings\Jason\Cookies\jason@itxt.vibrantmedia[1].txt
C:\Documents and Settings\Jason\Cookies\jason@casalemedia[2].txt
C:\Documents and Settings\Jason\Cookies\jason@webstat[2].txt
C:\Documents and Settings\Jason\Cookies\jason@cz3.clickzs[2].txt
C:\Documents and Settings\Jason\Cookies\jason@adbrite[1].txt
C:\Documents and Settings\Jason\Cookies\jason@adcentriconline[2].txt
C:\Documents and Settings\Jason\Cookies\jason@targetnet[1].txt
C:\Documents and Settings\Jason\Cookies\jason@ads.ak.facebook[1].txt
C:\Documents and Settings\Jason\Cookies\jason@tracker.pegsanalytics[2].txt
C:\Documents and Settings\Jason\Cookies\jason@msnportal.112.2o7[1].txt
C:\Documents and Settings\Jason\Cookies\jason@247realmedia[1].txt
C:\Documents and Settings\Jason\Cookies\jason@reztrack[1].txt
C:\Documents and Settings\Jason\Cookies\jason@ad[2].txt
C:\Documents and Settings\Jason\Cookies\jason@image.masterstats[1].txt
C:\Documents and Settings\Jason\Cookies\jason@008.free-counter.co[1].txt
C:\Documents and Settings\Jason\Cookies\jason@doubleclick[1].txt
C:\Documents and Settings\Jason\Cookies\jason@advertising[2].txt
C:\Documents and Settings\Jason\Cookies\jason@ads.pointroll[1].txt
C:\Documents and Settings\Jason\Cookies\jason@indextools[2].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[3].txt
C:\Documents and Settings\Jason\Cookies\jason@1068415716[2].txt
C:\Documents and Settings\Jason\Cookies\jason@counter.hitslink[1].txt
C:\Documents and Settings\Jason\Cookies\jason@atwola[1].txt
C:\Documents and Settings\Jason\Cookies\jason@a.websponsors[2].txt
C:\Documents and Settings\Jason\Cookies\jason@ad.yieldmanager[2].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[5].txt
C:\Documents and Settings\Jason\Cookies\jason@statcounter[2].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[2].txt
C:\Documents and Settings\Jason\Cookies\jason@1063670465[1].txt
C:\Documents and Settings\Jason\Cookies\jason@cgi-bin[4].txt
C:\Documents and Settings\Jason\Cookies\jason@tribalfusion[2].txt
C:\Documents and Settings\Jason\Cookies\jason@www.burstnet[1].txt
C:\Documents and Settings\Jason\Cookies\jason@ads.as4x.tmcs[2].txt
C:\Documents and Settings\Jason\Cookies\jason@stats[1].txt
C:\Documents and Settings\Jason\Cookies\jason@statse.webtrendslive[1].txt
C:\Documents and Settings\Jason\Cookies\jason@server.cpmstar[2].txt
C:\Documents and Settings\Jason\Cookies\jason@questionmarket[1].txt
C:\Documents and Settings\Jason\Cookies\jason@2o7[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mediaplex[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[4].txt
C:\Documents and Settings\Jason\Cookies\jason@atdmt[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mywebsearch[1].txt
Adware.180solutions/Search Assistant
C:\DOCUMENTS AND SETTINGS\JASON\LOCAL SETTINGS\TEMP\DEL2D5.TMP
Adware.Lop
C:\PROGRAM FILES\C2MEDIA\SETUP.EXE
Adware.HotBar (Low Risk)
C:\PROGRAM FILES\HBINST\HBINST.EXE
Worm.Alcra Variant
C:\WINDOWS\SYSTEM32\NETSTAT.COM
C:\WINDOWS\SYSTEM32\TASKKILL.COM
Generated 03/23/2007 at 05:35 AM
Application Version : 3.6.1000
Core Rules Database Version : 3205
Trace Rules Database Version: 1215
Scan type : Complete Scan
Total Scan Time : 03:16:39
Memory items scanned : 335
Memory threats detected : 1
Registry items scanned : 5002
Registry threats detected : 41
File items scanned : 54511
File threats detected : 57
Adware.MyWebSearch
C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\Programmable
C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable
HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\Programmable
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\TypeLib
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\Programmable
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\TypeLib
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKU\S-1-5-21-4025279379-1021817841-4004396944-1007\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE
Kontiki Download Manager Browser Helper Object
HKLM\Software\Classes\CLSID\{029CA12C-89C1-46a7-A3C7-82F2F98635CB}
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\InprocServer32
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\InprocServer32#ThreadingModel
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\ProgID
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\Programmable
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\TypeLib
HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\VersionIndependentProgID
C:\PROGRAM FILES\KONTIKI\BIN\BH304181.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029CA12C-89C1-46a7-A3C7-82F2F98635CB}
Adware.Tracking Cookie
C:\Documents and Settings\Jason\Cookies\jason@ctxtad[1].txt
C:\Documents and Settings\Jason\Cookies\jason@toplist[1].txt
C:\Documents and Settings\Jason\Cookies\jason@fastclick[2].txt
C:\Documents and Settings\Jason\Cookies\jason@burstnet[2].txt
C:\Documents and Settings\Jason\Cookies\jason@itxt.vibrantmedia[1].txt
C:\Documents and Settings\Jason\Cookies\jason@casalemedia[2].txt
C:\Documents and Settings\Jason\Cookies\jason@webstat[2].txt
C:\Documents and Settings\Jason\Cookies\jason@cz3.clickzs[2].txt
C:\Documents and Settings\Jason\Cookies\jason@adbrite[1].txt
C:\Documents and Settings\Jason\Cookies\jason@adcentriconline[2].txt
C:\Documents and Settings\Jason\Cookies\jason@targetnet[1].txt
C:\Documents and Settings\Jason\Cookies\jason@ads.ak.facebook[1].txt
C:\Documents and Settings\Jason\Cookies\jason@tracker.pegsanalytics[2].txt
C:\Documents and Settings\Jason\Cookies\jason@msnportal.112.2o7[1].txt
C:\Documents and Settings\Jason\Cookies\jason@247realmedia[1].txt
C:\Documents and Settings\Jason\Cookies\jason@reztrack[1].txt
C:\Documents and Settings\Jason\Cookies\jason@ad[2].txt
C:\Documents and Settings\Jason\Cookies\jason@image.masterstats[1].txt
C:\Documents and Settings\Jason\Cookies\jason@008.free-counter.co[1].txt
C:\Documents and Settings\Jason\Cookies\jason@doubleclick[1].txt
C:\Documents and Settings\Jason\Cookies\jason@advertising[2].txt
C:\Documents and Settings\Jason\Cookies\jason@ads.pointroll[1].txt
C:\Documents and Settings\Jason\Cookies\jason@indextools[2].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[3].txt
C:\Documents and Settings\Jason\Cookies\jason@1068415716[2].txt
C:\Documents and Settings\Jason\Cookies\jason@counter.hitslink[1].txt
C:\Documents and Settings\Jason\Cookies\jason@atwola[1].txt
C:\Documents and Settings\Jason\Cookies\jason@a.websponsors[2].txt
C:\Documents and Settings\Jason\Cookies\jason@ad.yieldmanager[2].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[5].txt
C:\Documents and Settings\Jason\Cookies\jason@statcounter[2].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[2].txt
C:\Documents and Settings\Jason\Cookies\jason@1063670465[1].txt
C:\Documents and Settings\Jason\Cookies\jason@cgi-bin[4].txt
C:\Documents and Settings\Jason\Cookies\jason@tribalfusion[2].txt
C:\Documents and Settings\Jason\Cookies\jason@www.burstnet[1].txt
C:\Documents and Settings\Jason\Cookies\jason@ads.as4x.tmcs[2].txt
C:\Documents and Settings\Jason\Cookies\jason@stats[1].txt
C:\Documents and Settings\Jason\Cookies\jason@statse.webtrendslive[1].txt
C:\Documents and Settings\Jason\Cookies\jason@server.cpmstar[2].txt
C:\Documents and Settings\Jason\Cookies\jason@questionmarket[1].txt
C:\Documents and Settings\Jason\Cookies\jason@2o7[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mediaplex[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[4].txt
C:\Documents and Settings\Jason\Cookies\jason@atdmt[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mb[1].txt
C:\Documents and Settings\Jason\Cookies\jason@mywebsearch[1].txt
Adware.180solutions/Search Assistant
C:\DOCUMENTS AND SETTINGS\JASON\LOCAL SETTINGS\TEMP\DEL2D5.TMP
Adware.Lop
C:\PROGRAM FILES\C2MEDIA\SETUP.EXE
Adware.HotBar (Low Risk)
C:\PROGRAM FILES\HBINST\HBINST.EXE
Worm.Alcra Variant
C:\WINDOWS\SYSTEM32\NETSTAT.COM
C:\WINDOWS\SYSTEM32\TASKKILL.COM
Hi,Jason86
Now was this any help to you did you try running HijackThis again
give me feedback here.
Gogo
Now was this any help to you did you try running HijackThis again
give me feedback here.
Gogo
CCleaner Log
CLEANING COMPLETE - (101.681 secs)
------------------------------------------------------------------------------------------
467.1MB removed.
------------------------------------------------------------------------------------------
Details of files deleted
------------------------------------------------------------------------------------------
IE Temporary Internet Files (4310 files) 194.2MB
Cookie:jason@weightwatchers.ca/(&H100001) 85 bytes
Cookie:jason@theblemish.us.intellitxt.com/(&H100001) 128 bytes
Cookie:jason@ichotelsgroup.com/(&H100001) 697 bytes
Cookie:jason@www.hbo.com/(&H100001) 97 bytes
Cookie:jason@forums.techguy.org/(&H100001) 375 bytes
Cookie:jason@ems1.aeroplan.com/a(&H100001) 101 bytes
Cookie:jason@1901.nordstrom.com/(&H100001) 99 bytes
Cookie:jason@www.cheatsnetwork.com/cheats/(&H100001) 88 bytes
Cookie:jason@support.microsoft.com/(&H100001) 182 bytes
Cookie:jason@afy11.net/(&H100001) 83 bytes
Cookie:jason@www.discountpokershop.com/(&H100001) 112 bytes
Cookie:jason@www.aveda.com/(&H100001) 600 bytes
Cookie:jason@www.flyordie.com/games/free/(&H100001) 84 bytes
Cookie:jason@login.bccampus.ca/(&H100001) 107 bytes
Cookie:jason@login.facebook.com/(&H100001) 89 bytes
Cookie:jason@m.webtrends.com/(&H100001) 244 bytes
Cookie:jason@www.theglobeandmail.com/(&H100001) 198 bytes
Cookie:jason@microsoft.com/(&H100001) 264 bytes
Cookie:jason@games.flyordie.com/(&H100001) 137 bytes
Cookie:jason@lovehappens.com/(&H100001) 184 bytes
Cookie:jason@search.sympatico.msn.ca/(&H100001) 530 bytes
Cookie:jason@bccampus.ca/(&H100001) 337 bytes
Cookie:jason@www.intel.com/(&H100001) 113 bytes
Cookie:jason@dinehere.ca/(&H100001) 353 bytes
Cookie:jason@www.weightwatchers.ca/(&H100001) 208 bytes
Cookie:jason@hotmail.msn.com/(&H100001) 70 bytes
Cookie:jason@quantserve.com/(&H100001) 94 bytes
Cookie:jason@free-beauty-tips.com/(&H100001) 81 bytes
Cookie:jason@surfaid.ihost.com/crc(&H100001) 126 bytes
Cookie:jason@www.lavasoftsupport.com/(&H100001) 629 bytes
Cookie:jason@infoplease.com/(&H100001) 764 bytes
Cookie:jason@www.aeroplan.com/(&H100001) 94 bytes
Cookie:jason@bookclubservices.ca/(&H100001) 90 bytes
Cookie:jason@sympatico.msn.ca/(&H100001) 170 bytes
Cookie:jason@ask.com/(&H100001) 78 bytes
Cookie:jason@www.trendsecure.com/(&H100001) 147 bytes
Cookie:jason@www.msn.com/(&H100001) 155 bytes
Cookie:jason@www.pacificpalisadeshotel.com/(&H100001) 419 bytes
Cookie:jason@www.bccampus.ca/(&H100001) 74 bytes
Cookie:jason@abmr.net/(&H100001) 258 bytes
Cookie:jason@mapquest.com/(&H100001) 454 bytes
Cookie:jason@www.ugoplayer.com/(&H100001) 237 bytes
Cookie:jason@ogoodideas.com/tgp/(&H100001) 168 bytes
Cookie:jason@sophos.fr/(&H100001) 377 bytes
Cookie:jason@www.cucardsonline.com/(&H100001) 80 bytes
Cookie:jason@www.ticketstonight.ca/(&H100001) 78 bytes
Cookie:jason@g.adspeed.net/(&H100001) 103 bytes
Cookie:jason@nordstrom.com/(&H100001) 204 bytes
Cookie:jason@google.ca/(&H100001) 130 bytes
Cookie:jason@kimpton.ibe.netbooker.com/(&H100001) 159 bytes
Cookie:jason@bbc.co.uk/(&H100001) 238 bytes
Cookie:jason@www.download.com/(&H100001) 177 bytes
Cookie:jason@www.studergroup.com/(&H100001) 99 bytes
Cookie:jason@www.thetrickery.com/(&H100001) 168 bytes
Cookie:jason@navrcholu.cz/(&H100001) 156 bytes
Cookie:jason@google.com/(&H100001) 200 bytes
Cookie:jason@demr.myspace.com/(&H100001) 83 bytes
Cookie:jason@www.mcssl.com/app(&H100001) 292 bytes
Cookie:jason@ssl-hints.netflame.cc/(&H100001) 536 bytes
Cookie:jason@www.opentable.com/(&H100001) 75 bytes
Cookie:jason@bcentral.com/(&H100001) 77 bytes
Cookie:jason@login.live.com/(&H100001) 175 bytes
Cookie:jason@estara.com/(&H100001) 120 bytes
Cookie:jason@messenger.msn.com/(&H100001) 95 bytes
Cookie:jason@www.baccobeverage.com/(&H100001) 122 bytes
Cookie:jason@feenies.com/(&H100001) 367 bytes
Cookie:jason@api.collarity.com/(&H100001) 115 bytes
Cookie:jason@adfarm.mserve.ca/(&H100001) 105 bytes
Cookie:jason@go2hr.ca/(&H100001) 291 bytes
Cookie:jason@decdna.net/n/20213(&H100001) 149 bytes
Cookie:jason@export.opentable.com/(&H100001) 78 bytes
Cookie:jason@portal.bccampus.ca/(&H100001) 112 bytes
Cookie:jason@kontera.com/(&H100001) 156 bytes
Cookie:jason@www.liutilities.com/(&H100001) 518 bytes
Cookie:jason@nymag.com/nymetro/arts/tv/reviews/9579/(&H100001) 108 bytes
Cookie:jason@working.canada.com/(&H100001) 394 bytes
Cookie:jason@tv.com/(&H100001) 233 bytes
Cookie:jason@www.elabs3.com/(&H100001) 128 bytes
Cookie:jason@myspace.com/(&H100001) 685 bytes
Cookie:jason@wavelit.com/(&H100001) 335 bytes
Cookie:jason@cls.ichotelsgroup.com/(&H100001) 100 bytes
Cookie:jason@tp.msn.com/en-ca/(&H100001) 71 bytes
Cookie:jason@inknoise.com/(&H100001) 104 bytes
Cookie:jason@invisionfree.com/Waiterblog_Forum(&H100001) 250 bytes
Cookie:jason@alaskaair.com/(&H100001) 224 bytes
Cookie:jason@edhelper.com/(&H100001) 334 bytes
Cookie:jason@techguy.org/(&H100001) 160 bytes
Cookie:jason@info.weightwatchers.ca/(&H100001) 121 bytes
Cookie:jason@www.uselessjunk.com/(&H100001) 87 bytes
Cookie:jason@hallmark.com/(&H100001) 221 bytes
Cookie:jason@attachments.techguy.org/(&H100001) 753 bytes
Cookie:jason@hbo.com/(&H100001) 102 bytes
Cookie:jason@perf.overture.com/(&H100001) 106 bytes
Cookie:jason@getfreecar.com/(&H100001) 271 bytes
Cookie:jason@landfood.ubc.ca/(&H100001) 269 bytes
Cookie:jason@rad.microsoft.com/(&H100001) 740 bytes
Cookie:jason@msn.ca/(&H100001) 294 bytes
Cookie:jason@dc.redenvelope.com/(&H100001) 99 bytes
Cookie:jason@dbbsrv.com/(&H100001) 88 bytes
Cookie:jason@data.coremetrics.com/(&H100001) 98 bytes
Cookie:jason@gayot.com/(&H100001) 362 bytes
Cookie:jason@search.msn.com/(&H100001) 208 bytes
Cookie:jason@www1.royalbank.com/(&H100001) 81 bytes
Cookie:jason@translink.bc.ca/(&H100001) 346 bytes
Cookie:jason@c3dsp.westjet.com/guest/(&H100001) 82 bytes
Cookie:jason@a.opentable.com/(&H100001) 1021 bytes
Cookie:jason@www.imdb.com/(&H100001) 273 bytes
Cookie:jason@www.hairstyle.com/(&H100001) 190 bytes
Cookie:jason@yahoo.com/(&H100001) 303 bytes
Cookie:jason@modernrock.com/(&H100001) 434 bytes
Cookie:jason@expedia.ca/(&H100001) 101 bytes
Cookie:jason@newgrounds.com/(&H100001) 364 bytes
Cookie:jason@element5.com/(&H100001) 90 bytes
Cookie:jason@opentable.com/(&H100001) 860 bytes
Cookie:jason@marriage.about.com/(&H100001) 89 bytes
Cookie:jason@devilducky.com/(&H100001) 294 bytes
Cookie:jason@c.topica.com/(&H100001) 187 bytes
Cookie:jason@facebook.com/(&H100001) 186 bytes
Cookie:jason@eggheaven.com/(&H100001) 368 bytes
Cookie:jason@mcssl.com/(&H100001) 103 bytes
Cookie:jason@www.weightwatchers.com/(&H100001) 202 bytes
Cookie:jason@www.eatyourbest.com/(&H100001) 89 bytes
Cookie:jason@amazon.com/(&H100001) 540 bytes
Cookie:jason@youtube.com/(&H100001) 458 bytes
Cookie:jason@pickuphockey.com/(&H100001) 349 bytes
Cookie:jason@www.linkedin.com/(&H100001) 377 bytes
Cookie:jason@offermatica.com/m2/cnet(&H100001) 203 bytes
Cookie:jason@123greetings.com/cgi-bin/(&H100001) 181 bytes
Cookie:jason@galaevents.ca/(&H100001) 343 bytes
Cookie:jason@flyordie.com/(&H100001) 417 bytes
Cookie:jason@ebaumsworld.com/(&H100001) 362 bytes
Cookie:jason@google.com/support/youtube/(&H100001) 414 bytes
Cookie:jason@optimizedby.rmxads.com/(&H100001) 180 bytes
Cookie:jason@www.tv.com/(&H100001) 155 bytes
Cookie:jason@download.com/(&H100001) 522 bytes
Cookie:jason@www.flashflashrevolution.com/(&H100001) 672 bytes
Cookie:jason@ca.yahoo.com/(&H100001) 134 bytes
Cookie:jason@sophos.co.jp/(&H100001) 389 bytes
Cookie:jason@weightwatchers.com/(&H100001) 87 bytes
Cookie:jason@www.adwarereport.com/(&H100001) 366 bytes
Cookie:jason@eyereturn.com/(&H100001) 185 bytes
Cookie:jason@twci.coremetrics.com/(&H100001) 100 bytes
Cookie:jason@ic-live.com/(&H100001) 87 bytes
Cookie:jason@info.weightwatchers.com/(&H100001) 121 bytes
Cookie:jason@tribalfusion.com/(&H100001) 162 bytes
Cookie:jason@nytimes.com/(&H100001) 337 bytes
Cookie:jason@www.superantispyware.com/(&H100001) 119 bytes
Cookie:jason@rad.msn.com/(&H100001) 690 bytes
Cookie:jason@weather.com/(&H100001) 607 bytes
Cookie:jason@cheatsnetwork.com/(&H100001) 392 bytes
Cookie:jason@sophos.com.au/(&H100001) 314 bytes
Cookie:jason@odysseybc.ca/(&H100001) 380 bytes
Cookie:jason@msn.com/(&H100001) 993 bytes
Cookie:jason@www.envisionfinancial.ca/(&H100001) 273 bytes
Cookie:jason@westjet.com/(&H100001) 351 bytes
Cookie:jason@www.newgrounds.com/(&H100001) 380 bytes
Cookie:jason@theblemish.com/(&H100001) 394 bytes
Cookie:jason@studergroup.com/(&H100001) 398 bytes
Cookie:jason@imdb.com/(&H100001) 505 bytes
Cookie:jason@raincoaster.com/(&H100001) 464 bytes
Cookie:jason@www.firsttimeauditions.com/(&H100001) 170 bytes
Cookie:jason@www.hallmark.com/(&H100001) 146 bytes
Cookie:jason@visit.theglobeandmail.com/(&H100001) 108 bytes
Cookie:jason@experts-exchange.com/(&H100001) 945 bytes
Cookie:jason@recommended-download.com/(&H100001) 415 bytes
Cookie:jason@www.infoplease.com/(&H100001) 104 bytes
Cookie:jason@delb2.myspace.com/(&H100001) 84 bytes
Cookie:jason@www.gcast.com/(&H100001) 102 bytes
Cookie:jason@www.fourseasons.com/(&H100001) 595 bytes
Cookie:jason@lthforum.com/bb(&H100001) 174 bytes
Cookie:jason@tripplanning.translink.bc.ca/(&H100001) 404 bytes
Cookie:jason@search.live.com/(&H100001) 295 bytes
Cookie:jason@www.edhelperblog.com/cgi-bin/(&H100001) 464 bytes
Cookie:jason@www.castlecops.com/(&H100001) 80 bytes
Cookie:jason@egullet.org/(&H100001) 392 bytes
Cookie:jason@www.flyordie.com/(&H100001) 164 bytes
Cookie:jason@www.garageband.com/(&H100001) 107 bytes
Cookie:jason@theglobeandmail.com/(&H100001) 178 bytes
Cookie:jason@forum.canucks.com/(&H100001) 175 bytes
Cookie:jason@forums.egullet.org/(&H100001) 359 bytes
Cookie:jason@com.com/(&H100001) 89 bytes
Cookie:jason@delb.myspace.com/(&H100001) 251 bytes
Cookie:jason@gayot.us.intellitxt.com/(&H100001) 122 bytes
Cookie:jason@store.softwareonline.com/(&H100001) 118 bytes
Cookie:jason@reference.com/(&H100001) 98 bytes
Cookie:jason@msdn2.microsoft.com/(&H100001) 176 bytes
Cookie:jason@c.bungie.net/(&H100001) 71 bytes
Cookie:jason@fourseasons.com/(&H100001) 75 bytes
Cookie:jason@www.canucks.com/(&H100001) 116 bytes
Cookie:jason@ftd.com/(&H100001) 541 bytes
Cookie:jason@www.lovehappens.com/(&H100001) 102 bytes
Cookie:jason@glam.com/(&H100001) 83 bytes
Cookie:jason@imc2.122.2o7.net/(&H100001) 114 bytes
Cookie:jason@hairstyles.free-beauty-tips.com/(&H100001) 92 bytes
Cookie:jason@thetalentjungle.com/(&H100001) 414 bytes
Cookie:jason@www.go2hr.ca/(&H100001) 137 bytes
Cookie:jason@egullet.com/(&H100001) 338 bytes
Cookie:jason@indexstats.com/(&H100001) 504 bytes
C:\Documents and Settings\Jason\Cookies\jason@login.live[2].txt 0 bytes
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\desktop.ini 113 bytes
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003060120030602\index.dat 48.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003083120030901\index.dat 0.16MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003092620030927\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003110720031108\index.dat 48.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004021520040216\index.dat 80.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004022220040223\index.dat 0.13MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004022920040301\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004030720040308\index.dat 0.22MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004031320040314\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004032120040322\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004071120040712\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004072820040729\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004072920040730\index.dat 48.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004100120041002\index.dat 0.17MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005010120050102\index.dat 0.13MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005012420050125\index.dat 64.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005012920050130\index.dat 0.13MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005022020050221\index.dat 0.16MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005040820050409\index.dat 80.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005041020050411\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005050420050505\index.dat 0.14MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005050620050507\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005051520050516\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005103020051031\index.dat 64.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005110620051107\index.dat 0.22MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005112020051121\index.dat 64.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005112620051127\index.dat 0.14MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005121820051219\index.dat 96.00KB
Marked for deletion: C:\Documents and Settings\Jason\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marked for deletion: C:\Documents and Settings\Jason\Cookies\index.dat
Marked for deletion: C:\Documents and Settings\Jason\Local Settings\History\History.IE5\index.dat
C:\WINDOWS\TEMP\DrvLsnr1119660357.log 1.95KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0108.cat 6.67KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0108.INF 1.11KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010a.cat 6.67KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4cb010A.inf 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010d.cat 6.70KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB010D.INF 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010e.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB010E.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0110.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0110.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0112.cat 6.67KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0112.INF 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0114.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0114.INF 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0116.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0116.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0118.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0118.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb011a.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB011A.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb011c.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB011C.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0109.cat 7.08KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0109.inf 2.35KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4CB0109.SYS 79.88KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb010b.cat 7.08KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010B.inf 2.36KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010B.sys 80.00KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb010f.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010F.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010F.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0111.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0111.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0111.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0113.cat 7.08KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0113.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0113.sys 80.00KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0115.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0115.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0115.sys 80.00KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0117.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0117.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0117.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0119.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0119.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0119.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb011b.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011B.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011B.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb011d.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011D.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011D.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0121.cat 7.02KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0121.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0121.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0123.cat 7.02KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0123.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0123.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0125.cat 7.02KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0125.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0125.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0127.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0127.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0127.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0129.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0129.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0129.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012b.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012B.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012B.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012d.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012D.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012D.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012f.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012F.inf 2.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012F.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0131.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0131.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0131.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013b.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013B.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013B.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013d.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013D.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013D.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013f.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013F.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013F.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\VC4CB104.INF 3.04KB
C:\WINDOWS\TEMP\FUJIUSBDRV\VC4CB104.SYS 80.00KB
C:\WINDOWS\TEMP\MSIc7c50.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\1.11.2.5464.enUS 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\1621B7.tmp 0.50MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\2nd annual Christmas letter.doc 4.47MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax101.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax112.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax14.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax146.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1649.tmp 66.65KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164D.tmp 68.03KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164E.tmp 66.65KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164F.tmp 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1650.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax17.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX18.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax19D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1A.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1AD7.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1AFF.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1E2.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax24E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax2F7.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax3.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax31.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34C.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34D.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34E.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34F.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX350.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX351.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX352.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX353.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax3DC.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax430.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax57C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX59.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX5A.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax622.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7E9.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7EA.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax85.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax85F.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxB2E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxCA.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxCB.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAXE3.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxE3E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxE6F.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAXEC.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\ABDComponents.dll 0.25MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Barbecue Glazed Pork Chops.doc 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\CmdLineExt02.dll 36.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\control.xml 12.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\cpuSI.dll 48.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-anim.png 17.39KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-burn.png 17.89KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-empty.png 15.23KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-full.png 14.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-layer.png 13.71KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\buttons.png 41.25KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\compact-resize.png 3.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\compact.png 3.33KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\divx.png 1.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\fullscreen.png 7.62KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\logo.png 2.31KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\main-resize.png 1.64KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\main.png 13.64KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\screenshot.png 26.87KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\skin.divl 39.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\tree-layer.png 13.09KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Doc1.doc 20.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\dsw345.tmp 2.66MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla131.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla132.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1377.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla158.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla159.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E0.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E1.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E2.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E3.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla167.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla168.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla19.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1A17.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1ACE.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1ACF.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1AD5.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1AD6.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1E1.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla217.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla25.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla26.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2DB.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2F.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3D8.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3DA.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3DE.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla4.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla5E1.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla69.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla7.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla87.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla88.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla89.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla8A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla8C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla90.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE38.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE39.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3B.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaF0.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\h2r33.tmp 4.22KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\h2r4.tmp 42.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\History\History.IE5\desktop.ini 113 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT14.xml 1.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT15.xml 426 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT16.xml 0.67MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT25.xml 1.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT26.xml 426 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT27.xml 0.67MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Install_Messenger.exe 18.0MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\InstHelp.dll 56.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\java_install_reg.log 41.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\jusched.log 88.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_autodelete.png 366 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1.png 307 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1_def.png 307 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1_ro.png 307 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1.png 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1_def.png 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1_ro.png 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_preview_bkgd.png 322 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175.png 484 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175_def.png 519 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175_ro.png 479 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175.png 323 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175_def.png 377 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175_ro.png 324 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\KDA6B.tmp 709 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\kmdb.html 843 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1266.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1267.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1268.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1269.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126a.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126b.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126c.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dcf.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd0.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd1.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd2.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd3.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19183.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19184.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19185.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19186.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19187.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19188.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19189.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918a.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918b.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918c.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918d.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918e.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918f.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19190.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1a083.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1a084.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI20540.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI20541.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1db.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1dc.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1dd.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1de.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1df.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e0.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e2.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e3.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c13.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c14.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c15.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c16.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca5.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca6.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca7.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca8.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca9.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcaa.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcab.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcac.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcad.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcae.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcaf.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcb0.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcb1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59616.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59617.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59618.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI64d7a.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI64d7b.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66402.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66403.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66404.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66405.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15a.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15b.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15c.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15d.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI79c93.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI79c94.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8e710.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8fed1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8fed2.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9782f.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI97830.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9a28c.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9b1e3.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9b1e4.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e7e.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e7f.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e80.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e81.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIbc77a.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIbc77b.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6345.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6346.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6347.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6348.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6349.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d3.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d4.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d5.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d6.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d7.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d8.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d9.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78da.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78db.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78dc.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78dd.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfc.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfd.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfe.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cff.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5d00.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5d01.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec2.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec3.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec4.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec5.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec6.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec7.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79d.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79e.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79f.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb7a0.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\msnsearch.exe 0.22MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso109.wmf 2.24MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso19FC.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso19FD.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso203.wmf 236 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso290.icm 3.07KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso2A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso2B.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso30.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso32C.doc 0.22MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso37A.wmf 9.68KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso399.wmf 15.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3A9.wmf 19.36KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3B9.wmf 30.48KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3C8.wmf 2.24MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso6D.wmf 0.29MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso9A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso9E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\msoCA.doc 30.78KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\msoE4.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSSSerif120.fon 87.58KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\msvbvm60.DLL 1.32MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PCloser.dll 28.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pconfig.dcf 123 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ph.msm 0.29MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PrimoSDK.dll 0.15MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\px.dll 0.36MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\px.msm 0.52MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxCpyA64.exe 55.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxCpyI64.exe 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxdrv.dll 0.40MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxdrv.msm 53.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelp20.inf 1.61KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelp20.sys 20.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxHelp64.sys 53.81KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.inf 1.35KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.sys 31.98KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.vxd 12.06KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxHlpa64.sys 26.09KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhpinst.exe 60.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxInsA64.exe 55.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxInsI64.exe 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxmas.dll 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxsetup.exe 60.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxwave.dll 0.32MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_de.qm 26.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_fr.qm 25.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_ja.qm 2.81KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-de.txt 3.77KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-en.txt 3.15KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-fr.txt 3.52KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-ja.txt 4.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_de.txt 4.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_en.txt 3.58KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_fr.txt 4.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_ja.txt 4.81KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\side-banner-divxforwindows.bmp 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\splash-screen-nostretch.ini 236 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\System.dll 9.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\toolbar-complete.bmp 24.66KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\toolbar-screenshot.bmp 57.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\version-check.ini 410 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\vxblock.dll 28.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\OLEAUT32.DLL 0.57MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\qmgr.cab 77.52KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\qmgr.inf 2.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Quest3D0\channels.lst 40.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17C.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17D.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17E.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17F.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set180.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set181.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set182.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set222.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set223.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set226.tmp 45.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set227.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set41.tmp 53.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set42.tmp 53.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set43.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set50.tmp 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set8C.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntf16.dll 11.78KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntf32.dll 19.46KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntfIcn.ani 4.48KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntfNT.dll 23.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SSUPDATE.EXE 0.14MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SysInfoGatherer.exe 0.29MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TempFolder.aaa\Macromedia.lok 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for EXFXJZ9J.ZIP\com\ms\wfc\data\adodb\Parameter.class 1.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for fable_521_wm.zip\fable_521.mpg 105.6MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for Peppers[1].zip\Peppers.pot 74.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for WinNotePad2003.zip\WinNotePad2003.exe 3.99MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 2 for Peppers[1].zip\Peppers.pot 74.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5XURS1MF\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\23ET8PWV\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\2H4DE5ST\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\8PMVCPYB\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\AQ6PH9KM\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\DO5P395R\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\EHK9AFAV\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\GD2RCD2Z\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\NVL9L992\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\PF7JD5CY\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\Q5D2ZEPW\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\QVMZ0941\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\S5M74HMR\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SB53EAN9\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\STUBIF0D\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\YWJ8826C\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR157.tmp 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR158.tmp 66.40KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR15C.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR161.tmp 9.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR166.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR169.tmp 22.88KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR16E.tmp 20.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR171.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR177.tmp 44.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR179.tmp 15.80KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR17D.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR181.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR185.tmp 45.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR189.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR18C.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR19B.tmp 0.12MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR19F.tmp 82.06KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR21.tmp 79.06KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR22.tmp 44.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR23.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR28.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR2E.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR32.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR33.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR34.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR37.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR38.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR39.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3C.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3D.tmp 45.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3E.tmp 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3F.tmp 66.40KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR40.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR52.tmp 44.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR53.tmp 15.80KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR58.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR5B.tmp 20.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR5F.tmp 22.88KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR63.tmp 9.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR64.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE3.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE4.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE6.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE7.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFREA.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFREE.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRF2.tmp 45.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRF3.tmp 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\theLogFile.txt 17.69KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp30B20.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp8DC20.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp95720.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmpE3920.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A0.tmp 7.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A1.tmp 5.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A2.tmp 7.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A3.tmp 5.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4B3.tmp 5.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4B4.tmp 7.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX83A.tmp 41.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\war3_Install.exe 0.28MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\wecerr.txt 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv19B.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv19C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv21.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv22.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Word8.0\MSForms.exd 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Yamasaki Rec's 051706 (2) (2).xls 26.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1C9.tmp 12.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1CB.tmp 9.96KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1CD.tmp 5.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1CF.tmp 6.84KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D1.tmp 6.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D3.tmp 12.56KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D5.tmp 27.14KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D7.tmp 4.88KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D9.tmp 18.42KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1DC.tmp 10.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1DE.tmp 8.15KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1CA.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1CC.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1CE.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D0.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D2.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D4.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D6.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D8.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1DA.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1DD.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1DF.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd1.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd10.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd11.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd12.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd2.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd3.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd4.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd5.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd6.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd7.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd8.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd9.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\halloween.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\knights.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\lewis.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\painted.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd1.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd10.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd11.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd12.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd2.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd3.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd4.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd5.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd6.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd7.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd8.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd9.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\halloween.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\knights.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\lewis.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\painted.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\Acrobat.bmp 31.52KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\AdobeIns.ini 6.11KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\BBrd1.BMP 0.12MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\BrwsrPI.dll 52.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\IccTest.dll 0.12MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\License.txt 21.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\Permission.dll 96.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\ShFolder.Exe 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\value.shl 5.41KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\__ArcadeDownloadFoler__dinerdash_EN_elgoog\RealOneArcadeBundle.exe 16.8MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\__ArcadeDownloadFoler__dinerdash_EN_elgoog\RngcBundler.exe 0.14MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}\pase201winen_US.override 320 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~$RO1762.doc 162 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d429b17d4b91c6c6d3de2bc00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d429b17d4b91c6c6d3de2bc00.jpg 2.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d42b515ea2a1c6c980ae113d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d42b515ea2a1c6c980ae113d00.jpg 1.92KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d476516040b1c6c4c035ae0600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d476516040b1c6c4c035ae0600.jpg 2.85KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~1c8eabee1451d1c68de7854cc300.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~1c8eabee1451d1c68de7854cc300.jpg 1.85KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d37f9141c181c6c9fd2cabc000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d37f9141c181c6c9fd2cabc000.jpg 2.22KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d42a113125d1c6c53d1c4f600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d42a113125d1c6c53d1c4f600.jpg 2.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d474c14c4321c6c45ddcad8600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d474c14c4321c6c45ddcad8600.jpg 2.25KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2660e312c1abe1c67c419750a100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2660e312c1abe1c67c419750a100.jpg 2.48KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2910bb2b9000361c4e85e63135e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2910bb2b9000361c4e85e63135e00.jpg 2.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d429a12aaae1c6c6cf10431700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d429a12aaae1c6c6cf10431700.jpg 1.37KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d42b4123fb21c6c941abdbbe00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d42b4123fb21c6c941abdbbe00.jpg 1.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d476416e2e11c6c4bf94bf4b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d476416e2e11c6c4bf94bf4b00.jpg 2.53KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d4289178ed61c6c631fa334900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d4289178ed61c6c631fa334900.jpg 2.97KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d429a1667951c6c9f564af0500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d429a1667951c6c9f564af0500.jpg 2.61KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d42ae17d5231c6c6f08dcb4f00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d42ae17d5231c6c6f08dcb4f00.jpg 1.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42891267691c6c632847bad00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42891267691c6c632847bad00.jpg 2.54KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42ae1544511c6c8679eea9c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42ae1544511c6c8679eea9c00.jpg 1.87KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42b3124aa21c6c667f8847800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42b3124aa21c6c667f8847800.jpg 2.39KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d474a1649621c6c528d6d0a700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d474a1649621c6c528d6d0a700.jpg 2.25KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47631178621c6c45d3e212500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47631178621c6c45d3e212500.jpg 1.60KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47671348a01c6c45496075e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47671348a01c6c45496075e00.jpg 1.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d477e1644cf1c6c4af93dbe00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d477e1644cf1c6c4af93dbe00.jpg 2.31KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3860e30ea641b1c67c41928bed00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3860e30ea641b1c67c41928bed00.jpg 2.07KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3f5d42bd13ef971c6c629cce29d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3f5d42bd13ef971c6c629cce29d00.jpg 2.56KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4260e30e827d41c67c4190299300.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4260e30e827d41c67c4190299300.jpg 2.19KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d429b13cf431c6c9fccaeb5600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d429b13cf431c6c9fccaeb5600.jpg 2.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d42af1651b11c6c6f359a7900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d42af1651b11c6c6f359a7900.jpg 2.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d474b14a6f81c6c526c6b7c800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d474b14a6f81c6c526c6b7c800.jpg 2.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d4766156df31c6c45482f48e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d4766156df31c6c45482f48e00.jpg 1.96KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~455d42bd147f351c6c62142963b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~455d42bd147f351c6c62142963b00.jpg 2.41KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~460e30e887e21c67c41961f7400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~460e30e887e21c67c41961f7400.jpg 2.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4758eb0a3b81c64bd212f68900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4758eb0a3b81c64bd212f68900.jpg 1.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~495d42bc1592711c6c629d79d3200.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~495d42bc1592711c6c629d79d3200.jpg 2.23KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4e60e30f74b291c67c4194ee4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4e60e30f74b291c67c4194ee4700.jpg 2.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5060e312cd8b71c67c419c155500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5060e312cd8b71c67c419c155500.jpg 2.12KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d429b15a59c1c6c98bd9e5f000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d429b15a59c1c6c98bd9e5f000.jpg 2.35KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42af1565c21c6c6ebea783b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42af1565c21c6c6ebea783b00.jpg 2.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42b6132ae41c6c6328a718e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42b6132ae41c6c6328a718e00.jpg 2.75KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~575d42a1172aff1c6c5691ae39c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~575d42a1172aff1c6c5691ae39c00.jpg 2.40KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d429b1426a71c6c9ef81e0d500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d429b1426a71c6c9ef81e0d500.jpg 2.10KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d42af15858d1c6c6ed80f92c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d42af15858d1c6c6ed80f92c00.jpg 2.03KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d474b16af5e1c6c4c9b7eef800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d474b16af5e1c6c4c9b7eef800.jpg 2.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d42b5142a761c6c86c71ecb800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d42b5142a761c6c86c71ecb800.jpg 1.70KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d474b15725f1c6c4a88580d300.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d474b15725f1c6c4a88580d300.jpg 1.32KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6660e327bd5c71c67c419fa8dc00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6660e327bd5c71c67c419fa8dc00.jpg 2.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6860e31381e411c67c419881ce00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6860e31381e411c67c419881ce00.jpg 2.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d42a013a9751c6c53d13a69900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d42a013a9751c6c53d13a69900.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d474d14395a1c6c49422854100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d474d14395a1c6c49422854100.jpg 2.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7060e30f8450f1c67c41961f7400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7060e30f8450f1c67c41961f7400.jpg 2.70KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~735d42bc145b891c6c62a42e70400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~735d42bc145b891c6c62a42e70400.jpg 2.60KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7460e30fc12d41c67c4194ee4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7460e30fc12d41c67c4194ee4700.jpg 2.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d428817179f1c6c62fea1a6a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d428817179f1c6c62fea1a6a00.jpg 2.44KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d429b1444e81c6c9ef87d6b600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d429b1444e81c6c9ef87d6b600.jpg 1.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d42af1714a41c6c6eff0701b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d42af1714a41c6c6eff0701b00.jpg 1.84KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d474b13f0761c6c4ca3c417b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d474b13f0761c6c4ca3c417b00.jpg 2.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d429c1499a11c6c6ceb2163400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d429c1499a11c6c6ceb2163400.jpg 1.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d42a116d3df1c6c600ede2c800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d42a116d3df1c6c600ede2c800.jpg 2.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~83601b0fe1f1c6e8b8a23a6400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~83601b0fe1f1c6e8b8a23a6400.jpg 2.89KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~8460e312d5bf51c67c419d468200.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~8460e312d5bf51c67c419d468200.jpg 2.09KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d42b5144e6f1c6c87a8a63cf00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d42b5144e6f1c6c87a8a63cf00.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d476517a0241c6c4bf7a856d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d476517a0241c6c4bf7a856d00.jpg 2.18KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~895d42b416f62a1c6c95d9b394100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~895d42b416f62a1c6c95d9b394100.jpg 1.85KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~92f49662148f41c6e8b87fa84b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~92f49662148f41c6e8b87fa84b00.jpg 3.60KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d4289154c441c6c6318349a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d4289154c441c6c6318349a00.jpg 2.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d42ae1760021c6c6f086a44100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d42ae1760021c6c6f086a44100.jpg 2.03KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42af1424a71c6c6f094f25d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42af1424a71c6c6f094f25d00.jpg 1.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42b212e2cf1c6c664531bd500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42b212e2cf1c6c664531bd500.jpg 2.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d474b1290971c6c4ced4d9fa00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d474b1290971c6c4ced4d9fa00.jpg 2.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d476213e6031c6c45d2053c000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d476213e6031c6c45d2053c000.jpg 1.89KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d477f15bdfc1c6c4aef88d4800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d477f15bdfc1c6c4aef88d4800.jpg 2.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9860e312a46ed1c67c4199b2fb00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9860e312a46ed1c67c4199b2fb00.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d429c14a9641c6c6c75b592c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d429c14a9641c6c6c75b592c00.jpg 1.66KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d42a1139dfa1c6c54773a23d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d42a1139dfa1c6c54773a23d00.jpg 1.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d474c14db371c6c4a22f51500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d474c14db371c6c4a22f51500.jpg 2.11KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~a15d42bd10a8cc1c6c62130b49800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~a15d42bd10a8cc1c6c62130b49800.jpg 2.42KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d429a1108731c6c9ee485b9a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d429a1108731c6c9ee485b9a00.jpg 1.43KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42ae168b741c6c6ed7c347800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42ae168b741c6c6ed7c347800.jpg 2.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b310713a1c6c662e2c08400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b310713a1c6c662e2c08400.jpg 1.77KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b711f4ad1c6c63426e86000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b711f4ad1c6c63426e86000.jpg 2.30KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d429a1454fb1c6c6d052208d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d429a1454fb1c6c6d052208d00.jpg 1.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d476416c1b01c6c4c0321a7f00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d476416c1b01c6c4c0321a7f00.jpg 2.68KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d429a15a9771c6c6e15d2fe900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d429a15a9771c6c6e15d2fe900.jpg 2.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d42b41653cf1c6c984bc615800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d42b41653cf1c6c984bc615800.jpg 2.45KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d476415ea531c6c4c03cd51400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d476415ea531c6c4c03cd51400.jpg 2.96KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b860e312c14211c67c4199b2fb00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b860e312c14211c67c4199b2fb00.jpg 2.32KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d429c16756a1c6c6cae687f100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d429c16756a1c6c6cae687f100.jpg 2.41KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d42a115cee91c6c5477866f100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d42a115cee91c6c5477866f100.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d474c16efb11c6c4a2cb3a9d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d474c16efb11c6c4a2cb3a9d00.jpg 2.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c260e312a151a1c67c419881ce00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c260e312a151a1c67c419881ce00.jpg 2.77KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d429b17af651c6c6d5ee995e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d429b17af651c6c6d5ee995e00.jpg 2.29KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d4765147a821c6c4c039418d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d4765147a821c6c4c039418d00.jpg 3.15KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c55d37f91500681c6c9fd44834400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c55d37f91500681c6c9fd44834400.jpg 2.51KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d429d159d371c6c6cccfa5c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d429d159d371c6c6cccfa5c00.jpg 2.30KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d42a01715711c6c5477d2ba500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d42a01715711c6c5477d2ba500.jpg 2.23KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d474d1351fa1c6c4a82c18a400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d474d1351fa1c6c4a82c18a400.jpg 1.55KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ce60e313c173f1c67c419ae42800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ce60e313c173f1c67c419ae42800.jpg 1.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d060e30e6d6201c67c4194ee4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d060e30e6d6201c67c4194ee4700.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d75d42bd172dcb1c6c62a47abb800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d75d42bd172dcb1c6c62a47abb800.jpg 2.69KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF1FC3.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF20F2.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF2587.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF26.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF27FE.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF331E.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF3870.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF3D4D.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF43B3.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF47F2.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF517B.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF58E.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF5B86.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d42b5153d731c6c95d7fce3600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d42b5153d731c6c95d7fce3600.jpg 2.32KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d474b16beb91c6c4abd3e3a100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d474b16beb91c6c4abd3e3a100.jpg 2.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d476516717a1c6c4c0157e4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d476516717a1c6c4c0157e4700.jpg 2.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF6C73.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF6CA4.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9434.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9815.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9E8F.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFA783.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFAD36.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFB848.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFC0BF.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFC187.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFCF25.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD17B.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD285.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD58A.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFDA34.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFDE06.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFE320.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFEA41.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFFD54.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d428817184b1c6c62fb2132700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d428817184b1c6c62fb2132700.jpg 2.51KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d42af15795a1c6c6e992d8d000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d42af15795a1c6c6e992d8d000.jpg 2.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d474b1418a81c6c4c0478fa900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d474b1418a81c6c4c0478fa900.jpg 2.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d476211c54e1c6c454a586a700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d476211c54e1c6c454a586a700.jpg 1.86KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e860e30fc7e161c67c4193bd1a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e860e30fc7e161c67c4193bd1a00.jpg 1.98KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ef5d42bc1428401c6c625960a8800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ef5d42bc1428401c6c625960a8800.jpg 2.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f35d474d1380b11c6c4a84b173600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f35d474d1380b11c6c4a84b173600.jpg 1.37KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f460e313aa9b71c67c419ae42800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f460e313aa9b71c67c419ae42800.jpg 2.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d429d11adb51c6c6ced3772000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d429d11adb51c6c6ced3772000.jpg 1.46KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d474d13f0c11c6c4a880bc1f00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d474d13f0c11c6c4a880bc1f00.jpg 2.29KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d429b143dd71c6c6cf2bae2200.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d429b143dd71c6c6cf2bae2200.jpg 1.43KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d42b516e7631c6c95d8bb9f800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d42b516e7631c6c95d8bb9f800.jpg 2.66KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d474b155b991c6c4abd8a85500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d474b155b991c6c4abd8a85500.jpg 2.31KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d4765165c881c6c4c01911ce00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d4765165c881c6c4c01911ce00.jpg 2.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRD0000.doc 5.90KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRD0001.doc 18.42KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF0000.tmp 1.09MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF0001.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF1229.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF1538.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF3741.tmp 2.80MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRL0827.tmp 42.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRL2214.tmp 51.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0000.tmp 14.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0001.tmp 0.25MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0002.tmp 0.19MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0003.tmp 44.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0004.tmp 91.65KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0005.tmp 15.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0006.tmp 12.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0007.tmp 3.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0281.tmp 100.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0491.tmp 82.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS3757.tmp 0.54MB
C:\WINDOWS\MiniDump\Mini032905-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini042506-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042506-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042606-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042606-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042706-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052105-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052106-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052106-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052106-03.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052606-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini080905-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini082405-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini082405-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini092105-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini092105-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini092905-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100105-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini100205-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100205-02.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100705-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100805-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100805-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini101005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini101605-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini101705-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini102005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102105-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102105-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102205-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102305-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini102305-02.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini102305-03.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102305-04.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102405-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102505-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102605-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini110605-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini110705-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini111005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini111005-02.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini111005-03.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini112105-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini113005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini120605-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini121905-01.dmp 64.00KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 65.29KB
C:\WINDOWS\system32\wbem\Logs\mofcomp.log 3.58KB
C:\WINDOWS\system32\wbem\Logs\NTEVT.log 2 bytes
C:\WINDOWS\system32\wbem\Logs\replog.log 401 bytes
C:\WINDOWS\system32\wbem\Logs\setup.log 653 bytes
C:\WINDOWS\system32\wbem\Logs\wbemess.log 52.75KB
C:\WINDOWS\system32\wbem\Logs\wbemprox.log 1.93KB
C:\WINDOWS\system32\wbem\Logs\WBEMSNMP.log 2 bytes
C:\WINDOWS\system32\wbem\Logs\WinMgmt.log 12.71KB
C:\WINDOWS\system32\wbem\Logs\wmiadap.log 2.35KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 29.99KB
C:\WINDOWS\system32\wbem\Logs\wbemess.lo_ 64.00KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.lo_ 64.03KB
C:\WINDOWS.log 0 bytes
C:\WINDOWS\cmsetacl.log 200 bytes
C:\WINDOWS\comsetup.log 0.29MB
C:\WINDOWS\dahotfix.log 17.96KB
C:\WINDOWS\DirectX.log 74.09KB
C:\WINDOWS\DtcInstall.log 115 bytes
C:\WINDOWS\FaxSetup.log 1.05MB
C:\WINDOWS\iis6.log 0.17MB
C:\WINDOWS\imsins.log 1.34KB
C:\WINDOWS\KB810217.log 15.05KB
C:\WINDOWS\KB821557.log 10.39KB
C:\WINDOWS\KB823182.log 13.13KB
C:\WINDOWS\KB823559.log 11.09KB
C:\WINDOWS\KB823980.log 11.70KB
C:\WINDOWS\KB824105.log 10.48KB
C:\WINDOWS\KB824141.log 9.01KB
C:\WINDOWS\KB824146.log 12.11KB
C:\WINDOWS\KB825119.log 11.73KB
C:\WINDOWS\KB828028.log 3.55KB
C:\WINDOWS\KB828035.log 8.78KB
C:\WINDOWS\KB828741.log 9.05KB
C:\WINDOWS\KB833987.log 3.35KB
C:\WINDOWS\KB834707.log 7.55KB
C:\WINDOWS\KB835732.log 68.45KB
C:\WINDOWS\KB837001.log 4.79KB
C:\WINDOWS\KB839643-DirectX9.log 2.64KB
C:\WINDOWS\KB839643.log 2.72KB
C:\WINDOWS\KB839645.log 6.08KB
C:\WINDOWS\KB840315.log 5.17KB
C:\WINDOWS\KB840374.log 16.76KB
C:\WINDOWS\KB841873.log 7.28KB
C:\WINDOWS\KB842773.log 5.21KB
C:\WINDOWS\KB867282.log 12.43KB
C:\WINDOWS\KB873333.log 12.64KB
C:\WINDOWS\KB873339.log 0.10MB
C:\WINDOWS\KB883357.log 2.92KB
C:\WINDOWS\KB883939.log 16.69KB
C:\WINDOWS\KB885250.log 16.26KB
C:\WINDOWS\KB885835.log 0.11MB
C:\WINDOWS\KB885836.log 0.10MB
C:\WINDOWS\KB886185.log 0.10MB
C:\WINDOWS\KB887472.log 15.23KB
C:\WINDOWS\KB887742.log 9.46KB
C:\WINDOWS\KB888113.log 15.96KB
C:\WINDOWS\KB888302.log 9.81KB
C:\WINDOWS\KB890046.log 11.29KB
C:\WINDOWS\KB890047.log 10.63KB
C:\WINDOWS\KB890175.log 43.83KB
C:\WINDOWS\KB890859.log 88.92KB
C:\WINDOWS\KB890923.log 91.64KB
C:\WINDOWS\KB891781.log 15.32KB
C:\WINDOWS\KB893066.log 100.19KB
C:\WINDOWS\KB893086.log 87.57KB
C:\WINDOWS\KB893756.log 18.32KB
C:\WINDOWS\KB893803.log 47.30KB
C:\WINDOWS\KB893803v2.log 9.53KB
C:\WINDOWS\KB894391.log 12.82KB
C:\WINDOWS\KB896358.log 11.48KB
C:\WINDOWS\KB896422.log 15.32KB
C:\WINDOWS\KB896423.log 17.62KB
C:\WINDOWS\KB896424.log 11.66KB
C:\WINDOWS\KB896428.log 10.00KB
C:\WINDOWS\KB896688.log 14.25KB
C:\WINDOWS\KB896727.log 18.65KB
C:\WINDOWS\KB898458.log 5.04KB
C:\WINDOWS\KB898461.log 6.72KB
C:\WINDOWS\KB899587.log 18.64KB
C:\WINDOWS\KB899588.log 13.15KB
C:\WINDOWS\KB899591.log 18.21KB
C:\WINDOWS\KB900485.log 11.02KB
C:\WINDOWS\KB900725.log 13.18KB
C:\WINDOWS\KB901017.log 20.46KB
C:\WINDOWS\KB901214.log 9.72KB
C:\WINDOWS\KB902400.log 23.33KB
C:\WINDOWS\KB903235.log 3.74KB
C:\WINDOWS\KB904706.log 10.85KB
C:\WINDOWS\KB905414.log 13.16KB
C:\WINDOWS\KB905749.log 11.54KB
C:\WINDOWS\KB905915.log 16.07KB
C:\WINDOWS\KB908519.log 9.90KB
C:\WINDOWS\KB908531.log 17.86KB
C:\WINDOWS\KB910437.log 9.67KB
C:\WINDOWS\KB911280.log 15.94KB
C:\WINDOWS\KB911562.log 17.04KB
C:\WINDOWS\KB911564.log 8.48KB
C:\WINDOWS\KB911565.log 8.38KB
C:\WINDOWS\KB911567.log 13.10KB
C:\WINDOWS\KB911927.log 10.51KB
C:\WINDOWS\KB912812.log 19.50KB
C:\WINDOWS\KB912919.log 10.85KB
C:\WINDOWS\KB913446.log 6.49KB
C:\WINDOWS\KB913580.log 17.76KB
C:\WINDOWS\KB914388.log 11.97KB
C:\WINDOWS\KB914389.log 11.32KB
C:\WINDOWS\KB916281.log 18.70KB
C:\WINDOWS\KB916595.log 10.17KB
C:\WINDOWS\KB917159.log 11.49KB
C:\WINDOWS\KB917344.log 16.99KB
C:\WINDOWS\KB917422.log 11.64KB
C:\WINDOWS\KB917734.log 14.72KB
C:\WINDOWS\KB917953.log 15.96KB
C:\WINDOWS\KB918118.log 15.54KB
C:\WINDOWS\KB918439.log 16.31KB
C:\WINDOWS\KB918899.log 20.69KB
C:\WINDOWS\KB919007.log 12.90KB
C:\WINDOWS\KB920213.log 24.23KB
C:\WINDOWS\KB920214.log 17.53KB
C:\WINDOWS\KB920670.log 12.28KB
C:\WINDOWS\KB920683.log 11.91KB
C:\WINDOWS\KB920685.log 12.75KB
C:\WINDOWS\KB920872.log 14.51KB
C:\WINDOWS\KB921398.log 18.02KB
C:\WINDOWS\KB921883.log 13.19KB
C:\WINDOWS\KB922582.log 8.97KB
C:\WINDOWS\KB922616.log 17.52KB
C:\WINDOWS\KB922760.log 25.76KB
C:\WINDOWS\KB922819.log 17.22KB
C:\WINDOWS\KB923191.log 13.01KB
C:\WINDOWS\KB923414.log 15.46KB
C:\WINDOWS\KB923689.log 11.38KB
C:\WINDOWS\KB923694.log 11.90KB
C:\WINDOWS\KB923723.log 9.08KB
C:\WINDOWS\KB923980.log 24.65KB
C:\WINDOWS\KB924191.log 17.57KB
C:\WINDOWS\KB924270.log 24.82KB
C:\WINDOWS\KB924496.log 15.45KB
C:\WINDOWS\KB924667.log 13.34KB
C:\WINDOWS\KB925398.log 10.38KB
C:\WINDOWS\KB925454.log 29.48KB
C:\WINDOWS\KB925486.log 12.08KB
C:\WINDOWS\KB926255.log 11.90KB
C:\WINDOWS\KB926436.log 15.25KB
C:\WINDOWS\KB927779.log 19.40KB
C:\WINDOWS\KB927802.log 16.27KB
C:\WINDOWS\KB928090.log 19.15KB
C:\WINDOWS\KB928255.log 16.80KB
C:\WINDOWS\KB928843.log 10.35KB
C:\WINDOWS\KB929338.log 11.78KB
C:\WINDOWS\KB929969.log 10.35KB
C:\WINDOWS\KB931836.log 25.53KB
C:\WINDOWS\msgsocm.log 54.15KB
C:\WINDOWS\nsw.log 489 bytes
C:\WINDOWS\ntdtcsetup.log 0.22MB
C:\WINDOWS\ocgen.log 0.41MB
C:\WINDOWS\ocmsn.log 52.27KB
C:\WINDOWS\Q306583.log 1.31KB
C:\WINDOWS\Q308402.log 4.20KB
C:\WINDOWS\Q308678.log 1.20KB
C:\WINDOWS\Q309521.log 7.85KB
C:\WINDOWS\Q311889.log 4.54KB
C:\WINDOWS\Q311967.log 5.80KB
C:\WINDOWS\Q312368.log 1.76KB
C:\WINDOWS\Q312370.log 3.89KB
C:\WINDOWS\Q313450.log 7.39KB
C:\WINDOWS\Q314147.log 5.85KB
C:\WINDOWS\Q314412.log 944 bytes
C:\WINDOWS\Q314862.log 5.79KB
C:\WINDOWS\Q315000.log 3.24KB
C:\WINDOWS\Q315403.log 2.35KB
C:\WINDOWS\Q317277.log 6.10KB
C:\WINDOWS\Q318138.log 7.12KB
C:\WINDOWS\Q319580.log 7.14KB
C:\WINDOWS\Q323172.log 7.70KB
C:\WINDOWS\Q323255.log 8.31KB
C:\WINDOWS\Q324096.log 8.32KB
C:\WINDOWS\Q324380.log 7.64KB
C:\WINDOWS\Q326147.log 4.17KB
C:\WINDOWS\Q326830.log 8.27KB
C:\WINDOWS\Q328310.log 11.11KB
C:\WINDOWS\Q328940.log 4.20KB
C:\WINDOWS\Q329048.log 8.27KB
C:\WINDOWS\Q329115.log 9.17KB
C:\WINDOWS\Q329170.log 11.07KB
C:\WINDOWS\Q329390.log 8.27KB
C:\WINDOWS\Q329441.log 12.74KB
C:\WINDOWS\Q329834.log 1.57KB
C:\WINDOWS\Q331953.log 23.58KB
C:\WINDOWS\Q810577.log 15.61KB
C:\WINDOWS\Q811493.log 19.24KB
C:\WINDOWS\Q811630.log 19.31KB
C:\WINDOWS\Q815021.log 12.49KB
C:\WINDOWS\Q817606.log 11.53KB
C:\WINDOWS\Q819696.log 11.23KB
C:\WINDOWS\Q828026.log 12.46KB
C:\WINDOWS\regopt.log 3.34KB
C:\WINDOWS\sessmgr.setup.log 3.55KB
C:\WINDOWS\setupact.log 4.64KB
C:\WINDOWS\setupapi.log 0.63MB
C:\WINDOWS\setuperr.log 0 bytes
C:\WINDOWS\spupdsvc.log 30.32KB
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\svcpack.log 0.49MB
C:\WINDOWS\tsoc.log 0.41MB
C:\WINDOWS\updspapi.log 55.10KB
C:\WINDOWS\vminst.log 2.00KB
C:\WINDOWS\WGA.log 8.30KB
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 50 bytes
C:\WINDOWS\Windows Update.log 0.20MB
C:\WINDOWS\wmsetup.log 79.27KB
C:\WINDOWS\xpsp1hfm.log 0.15MB
C:\WINDOWS\yacs.log 392 bytes
C:\WINDOWS\imsins.BAK 1.34KB
C:\WINDOWS\IE4 Error Log.txt 240 bytes
C:\WINDOWS\ntbtlog.txt 76.26KB
C:\WINDOWS\OEWABLog.txt 345 bytes
C:\WINDOWS\ReportMaker Plus Setup Log.txt 180 bytes
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log 44.3MB
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp 53.16KB
C:\WINDOWS\Debug\blastcln.log 286 bytes
C:\WINDOWS\Debug\mrt.log 18.64KB
C:\WINDOWS\Debug\NetSetup.LOG 6.91KB
C:\WINDOWS\security\logs\backup.log 2.87KB
C:\WINDOWS\security\logs\convert.log 3.37KB
C:\WINDOWS\security\logs\SceRoot.log 216 bytes
C:\WINDOWS\security\logs\scesetup.log 0.11MB
C:\WINDOWS\security\logs\scesrv.log 526 bytes
C:\WINDOWS\security\logs\update.log 6.99KB
C:\WINDOWS\security\logs\scecomp.old 2.42KB
------------------------------------------------------------------------------------------
CLEANING COMPLETE - (101.681 secs)
------------------------------------------------------------------------------------------
467.1MB removed.
------------------------------------------------------------------------------------------
Details of files deleted
------------------------------------------------------------------------------------------
IE Temporary Internet Files (4310 files) 194.2MB
Cookie:jason@weightwatchers.ca/(&H100001) 85 bytes
Cookie:jason@theblemish.us.intellitxt.com/(&H100001) 128 bytes
Cookie:jason@ichotelsgroup.com/(&H100001) 697 bytes
Cookie:jason@www.hbo.com/(&H100001) 97 bytes
Cookie:jason@forums.techguy.org/(&H100001) 375 bytes
Cookie:jason@ems1.aeroplan.com/a(&H100001) 101 bytes
Cookie:jason@1901.nordstrom.com/(&H100001) 99 bytes
Cookie:jason@www.cheatsnetwork.com/cheats/(&H100001) 88 bytes
Cookie:jason@support.microsoft.com/(&H100001) 182 bytes
Cookie:jason@afy11.net/(&H100001) 83 bytes
Cookie:jason@www.discountpokershop.com/(&H100001) 112 bytes
Cookie:jason@www.aveda.com/(&H100001) 600 bytes
Cookie:jason@www.flyordie.com/games/free/(&H100001) 84 bytes
Cookie:jason@login.bccampus.ca/(&H100001) 107 bytes
Cookie:jason@login.facebook.com/(&H100001) 89 bytes
Cookie:jason@m.webtrends.com/(&H100001) 244 bytes
Cookie:jason@www.theglobeandmail.com/(&H100001) 198 bytes
Cookie:jason@microsoft.com/(&H100001) 264 bytes
Cookie:jason@games.flyordie.com/(&H100001) 137 bytes
Cookie:jason@lovehappens.com/(&H100001) 184 bytes
Cookie:jason@search.sympatico.msn.ca/(&H100001) 530 bytes
Cookie:jason@bccampus.ca/(&H100001) 337 bytes
Cookie:jason@www.intel.com/(&H100001) 113 bytes
Cookie:jason@dinehere.ca/(&H100001) 353 bytes
Cookie:jason@www.weightwatchers.ca/(&H100001) 208 bytes
Cookie:jason@hotmail.msn.com/(&H100001) 70 bytes
Cookie:jason@quantserve.com/(&H100001) 94 bytes
Cookie:jason@free-beauty-tips.com/(&H100001) 81 bytes
Cookie:jason@surfaid.ihost.com/crc(&H100001) 126 bytes
Cookie:jason@www.lavasoftsupport.com/(&H100001) 629 bytes
Cookie:jason@infoplease.com/(&H100001) 764 bytes
Cookie:jason@www.aeroplan.com/(&H100001) 94 bytes
Cookie:jason@bookclubservices.ca/(&H100001) 90 bytes
Cookie:jason@sympatico.msn.ca/(&H100001) 170 bytes
Cookie:jason@ask.com/(&H100001) 78 bytes
Cookie:jason@www.trendsecure.com/(&H100001) 147 bytes
Cookie:jason@www.msn.com/(&H100001) 155 bytes
Cookie:jason@www.pacificpalisadeshotel.com/(&H100001) 419 bytes
Cookie:jason@www.bccampus.ca/(&H100001) 74 bytes
Cookie:jason@abmr.net/(&H100001) 258 bytes
Cookie:jason@mapquest.com/(&H100001) 454 bytes
Cookie:jason@www.ugoplayer.com/(&H100001) 237 bytes
Cookie:jason@ogoodideas.com/tgp/(&H100001) 168 bytes
Cookie:jason@sophos.fr/(&H100001) 377 bytes
Cookie:jason@www.cucardsonline.com/(&H100001) 80 bytes
Cookie:jason@www.ticketstonight.ca/(&H100001) 78 bytes
Cookie:jason@g.adspeed.net/(&H100001) 103 bytes
Cookie:jason@nordstrom.com/(&H100001) 204 bytes
Cookie:jason@google.ca/(&H100001) 130 bytes
Cookie:jason@kimpton.ibe.netbooker.com/(&H100001) 159 bytes
Cookie:jason@bbc.co.uk/(&H100001) 238 bytes
Cookie:jason@www.download.com/(&H100001) 177 bytes
Cookie:jason@www.studergroup.com/(&H100001) 99 bytes
Cookie:jason@www.thetrickery.com/(&H100001) 168 bytes
Cookie:jason@navrcholu.cz/(&H100001) 156 bytes
Cookie:jason@google.com/(&H100001) 200 bytes
Cookie:jason@demr.myspace.com/(&H100001) 83 bytes
Cookie:jason@www.mcssl.com/app(&H100001) 292 bytes
Cookie:jason@ssl-hints.netflame.cc/(&H100001) 536 bytes
Cookie:jason@www.opentable.com/(&H100001) 75 bytes
Cookie:jason@bcentral.com/(&H100001) 77 bytes
Cookie:jason@login.live.com/(&H100001) 175 bytes
Cookie:jason@estara.com/(&H100001) 120 bytes
Cookie:jason@messenger.msn.com/(&H100001) 95 bytes
Cookie:jason@www.baccobeverage.com/(&H100001) 122 bytes
Cookie:jason@feenies.com/(&H100001) 367 bytes
Cookie:jason@api.collarity.com/(&H100001) 115 bytes
Cookie:jason@adfarm.mserve.ca/(&H100001) 105 bytes
Cookie:jason@go2hr.ca/(&H100001) 291 bytes
Cookie:jason@decdna.net/n/20213(&H100001) 149 bytes
Cookie:jason@export.opentable.com/(&H100001) 78 bytes
Cookie:jason@portal.bccampus.ca/(&H100001) 112 bytes
Cookie:jason@kontera.com/(&H100001) 156 bytes
Cookie:jason@www.liutilities.com/(&H100001) 518 bytes
Cookie:jason@nymag.com/nymetro/arts/tv/reviews/9579/(&H100001) 108 bytes
Cookie:jason@working.canada.com/(&H100001) 394 bytes
Cookie:jason@tv.com/(&H100001) 233 bytes
Cookie:jason@www.elabs3.com/(&H100001) 128 bytes
Cookie:jason@myspace.com/(&H100001) 685 bytes
Cookie:jason@wavelit.com/(&H100001) 335 bytes
Cookie:jason@cls.ichotelsgroup.com/(&H100001) 100 bytes
Cookie:jason@tp.msn.com/en-ca/(&H100001) 71 bytes
Cookie:jason@inknoise.com/(&H100001) 104 bytes
Cookie:jason@invisionfree.com/Waiterblog_Forum(&H100001) 250 bytes
Cookie:jason@alaskaair.com/(&H100001) 224 bytes
Cookie:jason@edhelper.com/(&H100001) 334 bytes
Cookie:jason@techguy.org/(&H100001) 160 bytes
Cookie:jason@info.weightwatchers.ca/(&H100001) 121 bytes
Cookie:jason@www.uselessjunk.com/(&H100001) 87 bytes
Cookie:jason@hallmark.com/(&H100001) 221 bytes
Cookie:jason@attachments.techguy.org/(&H100001) 753 bytes
Cookie:jason@hbo.com/(&H100001) 102 bytes
Cookie:jason@perf.overture.com/(&H100001) 106 bytes
Cookie:jason@getfreecar.com/(&H100001) 271 bytes
Cookie:jason@landfood.ubc.ca/(&H100001) 269 bytes
Cookie:jason@rad.microsoft.com/(&H100001) 740 bytes
Cookie:jason@msn.ca/(&H100001) 294 bytes
Cookie:jason@dc.redenvelope.com/(&H100001) 99 bytes
Cookie:jason@dbbsrv.com/(&H100001) 88 bytes
Cookie:jason@data.coremetrics.com/(&H100001) 98 bytes
Cookie:jason@gayot.com/(&H100001) 362 bytes
Cookie:jason@search.msn.com/(&H100001) 208 bytes
Cookie:jason@www1.royalbank.com/(&H100001) 81 bytes
Cookie:jason@translink.bc.ca/(&H100001) 346 bytes
Cookie:jason@c3dsp.westjet.com/guest/(&H100001) 82 bytes
Cookie:jason@a.opentable.com/(&H100001) 1021 bytes
Cookie:jason@www.imdb.com/(&H100001) 273 bytes
Cookie:jason@www.hairstyle.com/(&H100001) 190 bytes
Cookie:jason@yahoo.com/(&H100001) 303 bytes
Cookie:jason@modernrock.com/(&H100001) 434 bytes
Cookie:jason@expedia.ca/(&H100001) 101 bytes
Cookie:jason@newgrounds.com/(&H100001) 364 bytes
Cookie:jason@element5.com/(&H100001) 90 bytes
Cookie:jason@opentable.com/(&H100001) 860 bytes
Cookie:jason@marriage.about.com/(&H100001) 89 bytes
Cookie:jason@devilducky.com/(&H100001) 294 bytes
Cookie:jason@c.topica.com/(&H100001) 187 bytes
Cookie:jason@facebook.com/(&H100001) 186 bytes
Cookie:jason@eggheaven.com/(&H100001) 368 bytes
Cookie:jason@mcssl.com/(&H100001) 103 bytes
Cookie:jason@www.weightwatchers.com/(&H100001) 202 bytes
Cookie:jason@www.eatyourbest.com/(&H100001) 89 bytes
Cookie:jason@amazon.com/(&H100001) 540 bytes
Cookie:jason@youtube.com/(&H100001) 458 bytes
Cookie:jason@pickuphockey.com/(&H100001) 349 bytes
Cookie:jason@www.linkedin.com/(&H100001) 377 bytes
Cookie:jason@offermatica.com/m2/cnet(&H100001) 203 bytes
Cookie:jason@123greetings.com/cgi-bin/(&H100001) 181 bytes
Cookie:jason@galaevents.ca/(&H100001) 343 bytes
Cookie:jason@flyordie.com/(&H100001) 417 bytes
Cookie:jason@ebaumsworld.com/(&H100001) 362 bytes
Cookie:jason@google.com/support/youtube/(&H100001) 414 bytes
Cookie:jason@optimizedby.rmxads.com/(&H100001) 180 bytes
Cookie:jason@www.tv.com/(&H100001) 155 bytes
Cookie:jason@download.com/(&H100001) 522 bytes
Cookie:jason@www.flashflashrevolution.com/(&H100001) 672 bytes
Cookie:jason@ca.yahoo.com/(&H100001) 134 bytes
Cookie:jason@sophos.co.jp/(&H100001) 389 bytes
Cookie:jason@weightwatchers.com/(&H100001) 87 bytes
Cookie:jason@www.adwarereport.com/(&H100001) 366 bytes
Cookie:jason@eyereturn.com/(&H100001) 185 bytes
Cookie:jason@twci.coremetrics.com/(&H100001) 100 bytes
Cookie:jason@ic-live.com/(&H100001) 87 bytes
Cookie:jason@info.weightwatchers.com/(&H100001) 121 bytes
Cookie:jason@tribalfusion.com/(&H100001) 162 bytes
Cookie:jason@nytimes.com/(&H100001) 337 bytes
Cookie:jason@www.superantispyware.com/(&H100001) 119 bytes
Cookie:jason@rad.msn.com/(&H100001) 690 bytes
Cookie:jason@weather.com/(&H100001) 607 bytes
Cookie:jason@cheatsnetwork.com/(&H100001) 392 bytes
Cookie:jason@sophos.com.au/(&H100001) 314 bytes
Cookie:jason@odysseybc.ca/(&H100001) 380 bytes
Cookie:jason@msn.com/(&H100001) 993 bytes
Cookie:jason@www.envisionfinancial.ca/(&H100001) 273 bytes
Cookie:jason@westjet.com/(&H100001) 351 bytes
Cookie:jason@www.newgrounds.com/(&H100001) 380 bytes
Cookie:jason@theblemish.com/(&H100001) 394 bytes
Cookie:jason@studergroup.com/(&H100001) 398 bytes
Cookie:jason@imdb.com/(&H100001) 505 bytes
Cookie:jason@raincoaster.com/(&H100001) 464 bytes
Cookie:jason@www.firsttimeauditions.com/(&H100001) 170 bytes
Cookie:jason@www.hallmark.com/(&H100001) 146 bytes
Cookie:jason@visit.theglobeandmail.com/(&H100001) 108 bytes
Cookie:jason@experts-exchange.com/(&H100001) 945 bytes
Cookie:jason@recommended-download.com/(&H100001) 415 bytes
Cookie:jason@www.infoplease.com/(&H100001) 104 bytes
Cookie:jason@delb2.myspace.com/(&H100001) 84 bytes
Cookie:jason@www.gcast.com/(&H100001) 102 bytes
Cookie:jason@www.fourseasons.com/(&H100001) 595 bytes
Cookie:jason@lthforum.com/bb(&H100001) 174 bytes
Cookie:jason@tripplanning.translink.bc.ca/(&H100001) 404 bytes
Cookie:jason@search.live.com/(&H100001) 295 bytes
Cookie:jason@www.edhelperblog.com/cgi-bin/(&H100001) 464 bytes
Cookie:jason@www.castlecops.com/(&H100001) 80 bytes
Cookie:jason@egullet.org/(&H100001) 392 bytes
Cookie:jason@www.flyordie.com/(&H100001) 164 bytes
Cookie:jason@www.garageband.com/(&H100001) 107 bytes
Cookie:jason@theglobeandmail.com/(&H100001) 178 bytes
Cookie:jason@forum.canucks.com/(&H100001) 175 bytes
Cookie:jason@forums.egullet.org/(&H100001) 359 bytes
Cookie:jason@com.com/(&H100001) 89 bytes
Cookie:jason@delb.myspace.com/(&H100001) 251 bytes
Cookie:jason@gayot.us.intellitxt.com/(&H100001) 122 bytes
Cookie:jason@store.softwareonline.com/(&H100001) 118 bytes
Cookie:jason@reference.com/(&H100001) 98 bytes
Cookie:jason@msdn2.microsoft.com/(&H100001) 176 bytes
Cookie:jason@c.bungie.net/(&H100001) 71 bytes
Cookie:jason@fourseasons.com/(&H100001) 75 bytes
Cookie:jason@www.canucks.com/(&H100001) 116 bytes
Cookie:jason@ftd.com/(&H100001) 541 bytes
Cookie:jason@www.lovehappens.com/(&H100001) 102 bytes
Cookie:jason@glam.com/(&H100001) 83 bytes
Cookie:jason@imc2.122.2o7.net/(&H100001) 114 bytes
Cookie:jason@hairstyles.free-beauty-tips.com/(&H100001) 92 bytes
Cookie:jason@thetalentjungle.com/(&H100001) 414 bytes
Cookie:jason@www.go2hr.ca/(&H100001) 137 bytes
Cookie:jason@egullet.com/(&H100001) 338 bytes
Cookie:jason@indexstats.com/(&H100001) 504 bytes
C:\Documents and Settings\Jason\Cookies\jason@login.live[2].txt 0 bytes
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\desktop.ini 113 bytes
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003060120030602\index.dat 48.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003083120030901\index.dat 0.16MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003092620030927\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003110720031108\index.dat 48.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004021520040216\index.dat 80.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004022220040223\index.dat 0.13MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004022920040301\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004030720040308\index.dat 0.22MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004031320040314\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004032120040322\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004071120040712\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004072820040729\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004072920040730\index.dat 48.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004100120041002\index.dat 0.17MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005010120050102\index.dat 0.13MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005012420050125\index.dat 64.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005012920050130\index.dat 0.13MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005022020050221\index.dat 0.16MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005040820050409\index.dat 80.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005041020050411\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005050420050505\index.dat 0.14MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005050620050507\index.dat 0.11MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005051520050516\index.dat 96.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005103020051031\index.dat 64.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005110620051107\index.dat 0.22MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005112020051121\index.dat 64.00KB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005112620051127\index.dat 0.14MB
C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005121820051219\index.dat 96.00KB
Marked for deletion: C:\Documents and Settings\Jason\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marked for deletion: C:\Documents and Settings\Jason\Cookies\index.dat
Marked for deletion: C:\Documents and Settings\Jason\Local Settings\History\History.IE5\index.dat
C:\WINDOWS\TEMP\DrvLsnr1119660357.log 1.95KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0108.cat 6.67KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0108.INF 1.11KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010a.cat 6.67KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4cb010A.inf 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010d.cat 6.70KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB010D.INF 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010e.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB010E.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0110.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0110.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0112.cat 6.67KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0112.INF 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0114.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0114.INF 1.12KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0116.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0116.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0118.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0118.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb011a.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB011A.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb011c.cat 6.66KB
C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB011C.INF 1.21KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0109.cat 7.08KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0109.inf 2.35KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4CB0109.SYS 79.88KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb010b.cat 7.08KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010B.inf 2.36KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010B.sys 80.00KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb010f.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010F.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010F.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0111.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0111.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0111.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0113.cat 7.08KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0113.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0113.sys 80.00KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0115.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0115.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0115.sys 80.00KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0117.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0117.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0117.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0119.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0119.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0119.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb011b.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011B.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011B.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb011d.cat 7.06KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011D.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011D.sys 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0121.cat 7.02KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0121.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0121.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0123.cat 7.02KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0123.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0123.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0125.cat 7.02KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0125.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0125.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0127.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0127.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0127.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0129.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0129.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0129.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012b.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012B.inf 2.37KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012B.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012d.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012D.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012D.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012f.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012F.inf 2.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012F.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0131.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0131.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0131.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013b.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013B.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013B.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013d.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013D.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013D.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013f.cat 7.44KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013F.inf 2.40KB
C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013F.SYS 79.79KB
C:\WINDOWS\TEMP\FUJIUSBDRV\VC4CB104.INF 3.04KB
C:\WINDOWS\TEMP\FUJIUSBDRV\VC4CB104.SYS 80.00KB
C:\WINDOWS\TEMP\MSIc7c50.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\1.11.2.5464.enUS 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\1621B7.tmp 0.50MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\2nd annual Christmas letter.doc 4.47MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax101.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax112.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax14.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax146.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1649.tmp 66.65KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164D.tmp 68.03KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164E.tmp 66.65KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164F.tmp 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1650.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax17.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX18.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax19D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1A.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1AD7.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1AFF.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1E2.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax24E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax2F7.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax3.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax31.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34C.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34D.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34E.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34F.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX350.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX351.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX352.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX353.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax3DC.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax430.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax57C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX59.tmp 31.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX5A.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax622.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7E9.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7EA.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax85.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aax85F.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxB2E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxCA.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxCB.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAXE3.tmp 33.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxE3E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxE6F.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\AAXEC.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\ABDComponents.dll 0.25MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Barbecue Glazed Pork Chops.doc 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\CmdLineExt02.dll 36.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\control.xml 12.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\cpuSI.dll 48.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-anim.png 17.39KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-burn.png 17.89KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-empty.png 15.23KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-full.png 14.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-layer.png 13.71KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\buttons.png 41.25KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\compact-resize.png 3.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\compact.png 3.33KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\divx.png 1.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\fullscreen.png 7.62KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\logo.png 2.31KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\main-resize.png 1.64KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\main.png 13.64KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\screenshot.png 26.87KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\skin.divl 39.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\tree-layer.png 13.09KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Doc1.doc 20.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\dsw345.tmp 2.66MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla131.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla132.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1377.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla158.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla159.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E0.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E1.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E2.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E3.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla167.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla168.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla19.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1A17.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1ACE.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1ACF.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1AD5.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1AD6.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1E1.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla217.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla25.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla26.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2DB.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2F.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3D8.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3DA.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3DE.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla4.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla5E1.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla69.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla7.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla87.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla88.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla89.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla8A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla8C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\fla90.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE38.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE39.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3B.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3D.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\flaF0.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\h2r33.tmp 4.22KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\h2r4.tmp 42.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\History\History.IE5\desktop.ini 113 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT14.xml 1.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT15.xml 426 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT16.xml 0.67MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT25.xml 1.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT26.xml 426 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT27.xml 0.67MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Install_Messenger.exe 18.0MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\InstHelp.dll 56.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\java_install_reg.log 41.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\jusched.log 88.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_autodelete.png 366 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1.png 307 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1_def.png 307 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1_ro.png 307 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1.png 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1_def.png 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1_ro.png 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_preview_bkgd.png 322 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175.png 484 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175_def.png 519 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175_ro.png 479 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175.png 323 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175_def.png 377 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175_ro.png 324 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\KDA6B.tmp 709 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\kmdb.html 843 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1266.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1267.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1268.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1269.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126a.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126b.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126c.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dcf.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd0.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd1.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd2.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd3.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19183.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19184.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19185.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19186.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19187.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19188.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19189.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918a.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918b.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918c.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918d.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918e.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918f.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19190.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1a083.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1a084.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI20540.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI20541.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1db.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1dc.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1dd.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1de.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1df.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e0.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e2.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e3.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c13.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c14.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c15.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c16.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca5.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca6.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca7.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca8.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca9.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcaa.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcab.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcac.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcad.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcae.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcaf.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcb0.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcb1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59616.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59617.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59618.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI64d7a.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI64d7b.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66402.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66403.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66404.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66405.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15a.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15b.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15c.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15d.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI79c93.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI79c94.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8e710.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8fed1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8fed2.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9782f.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI97830.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9a28c.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9b1e3.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9b1e4.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e7e.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e7f.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e80.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e81.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIbc77a.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIbc77b.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6345.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6346.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6347.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6348.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6349.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d3.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d4.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d5.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d6.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d7.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d8.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d9.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78da.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78db.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78dc.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78dd.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfc.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfd.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfe.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cff.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5d00.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5d01.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec1.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec2.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec3.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec4.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec5.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec6.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec7.LOG 348 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79d.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79e.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79f.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb7a0.LOG 350 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\msnsearch.exe 0.22MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso109.wmf 2.24MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso19FC.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso19FD.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso203.wmf 236 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso290.icm 3.07KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso2A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso2B.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso30.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso32C.doc 0.22MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso37A.wmf 9.68KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso399.wmf 15.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3A9.wmf 19.36KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3B9.wmf 30.48KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3C8.wmf 2.24MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso6D.wmf 0.29MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso9A.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\mso9E.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\msoCA.doc 30.78KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\msoE4.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\MSSSerif120.fon 87.58KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\msvbvm60.DLL 1.32MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PCloser.dll 28.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pconfig.dcf 123 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ph.msm 0.29MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PrimoSDK.dll 0.15MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\px.dll 0.36MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\px.msm 0.52MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxCpyA64.exe 55.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxCpyI64.exe 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxdrv.dll 0.40MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxdrv.msm 53.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelp20.inf 1.61KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelp20.sys 20.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxHelp64.sys 53.81KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.inf 1.35KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.sys 31.98KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.vxd 12.06KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxHlpa64.sys 26.09KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhpinst.exe 60.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxInsA64.exe 55.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxInsI64.exe 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxmas.dll 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxsetup.exe 60.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxwave.dll 0.32MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_de.qm 26.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_fr.qm 25.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_ja.qm 2.81KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-de.txt 3.77KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-en.txt 3.15KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-fr.txt 3.52KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-ja.txt 4.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_de.txt 4.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_en.txt 3.58KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_fr.txt 4.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_ja.txt 4.81KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\side-banner-divxforwindows.bmp 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\splash-screen-nostretch.ini 236 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\System.dll 9.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\toolbar-complete.bmp 24.66KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\toolbar-screenshot.bmp 57.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\version-check.ini 410 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\vxblock.dll 28.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\OLEAUT32.DLL 0.57MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\qmgr.cab 77.52KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\qmgr.inf 2.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Quest3D0\channels.lst 40.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17C.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17D.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17E.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17F.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set180.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set181.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set182.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set222.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set223.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set226.tmp 45.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set227.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set41.tmp 53.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set42.tmp 53.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set43.tmp 0.10MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Set50.tmp 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\set8C.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntf16.dll 11.78KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntf32.dll 19.46KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntfIcn.ani 4.48KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntfNT.dll 23.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SSUPDATE.EXE 0.14MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\SysInfoGatherer.exe 0.29MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TempFolder.aaa\Macromedia.lok 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for EXFXJZ9J.ZIP\com\ms\wfc\data\adodb\Parameter.class 1.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for fable_521_wm.zip\fable_521.mpg 105.6MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for Peppers[1].zip\Peppers.pot 74.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for WinNotePad2003.zip\WinNotePad2003.exe 3.99MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 2 for Peppers[1].zip\Peppers.pot 74.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5XURS1MF\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\23ET8PWV\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\2H4DE5ST\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\8PMVCPYB\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\AQ6PH9KM\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\DO5P395R\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\EHK9AFAV\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\GD2RCD2Z\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\NVL9L992\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\PF7JD5CY\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\Q5D2ZEPW\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\QVMZ0941\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\S5M74HMR\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SB53EAN9\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\STUBIF0D\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\YWJ8826C\desktop.ini 67 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR157.tmp 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR158.tmp 66.40KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR15C.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR161.tmp 9.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR166.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR169.tmp 22.88KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR16E.tmp 20.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR171.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR177.tmp 44.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR179.tmp 15.80KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR17D.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR181.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR185.tmp 45.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR189.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR18C.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR19B.tmp 0.12MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR19F.tmp 82.06KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR21.tmp 79.06KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR22.tmp 44.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR23.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR28.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR2E.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR32.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR33.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR34.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR37.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR38.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR39.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3C.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3D.tmp 45.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3E.tmp 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3F.tmp 66.40KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR40.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR52.tmp 44.94KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR53.tmp 15.80KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR58.tmp 23.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR5B.tmp 20.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR5F.tmp 22.88KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR63.tmp 9.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR64.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE3.tmp 34.74KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE4.tmp 61.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE6.tmp 39.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE7.tmp 22.72KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFREA.tmp 20.08KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFREE.tmp 57.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRF2.tmp 45.57KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRF3.tmp 37.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\theLogFile.txt 17.69KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp30B20.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp8DC20.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp95720.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\tmpE3920.FOT 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A0.tmp 7.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A1.tmp 5.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A2.tmp 7.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A3.tmp 5.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4B3.tmp 5.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4B4.tmp 7.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX83A.tmp 41.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\war3_Install.exe 0.28MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\wecerr.txt 271 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv19B.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv19C.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv21.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv22.tmp 0 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\Word8.0\MSForms.exd 0.16MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Yamasaki Rec's 051706 (2) (2).xls 26.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1C9.tmp 12.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1CB.tmp 9.96KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1CD.tmp 5.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1CF.tmp 6.84KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D1.tmp 6.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D3.tmp 12.56KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D5.tmp 27.14KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D7.tmp 4.88KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1D9.tmp 18.42KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1DC.tmp 10.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@R1DE.tmp 8.15KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1CA.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1CC.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1CE.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D0.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D2.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D4.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D6.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1D8.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1DA.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1DD.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\Z@S1DF.tmp 1.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd1.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd10.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd11.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd12.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd2.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd3.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd4.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd5.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd6.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd7.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd8.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd9.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\halloween.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\knights.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\lewis.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\painted.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd1.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd10.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd11.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd12.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd2.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd3.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd4.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd5.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd6.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd7.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd8.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd9.bmp 1.37MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\halloween.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\knights.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\lewis.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\painted.bmp 94.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\Acrobat.bmp 31.52KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\AdobeIns.ini 6.11KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\BBrd1.BMP 0.12MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\BrwsrPI.dll 52.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\IccTest.dll 0.12MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\License.txt 21.99KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\Permission.dll 96.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\ShFolder.Exe 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\value.shl 5.41KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\__ArcadeDownloadFoler__dinerdash_EN_elgoog\RealOneArcadeBundle.exe 16.8MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\__ArcadeDownloadFoler__dinerdash_EN_elgoog\RngcBundler.exe 0.14MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}\pase201winen_US.override 320 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~$RO1762.doc 162 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d429b17d4b91c6c6d3de2bc00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d429b17d4b91c6c6d3de2bc00.jpg 2.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d42b515ea2a1c6c980ae113d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d42b515ea2a1c6c980ae113d00.jpg 1.92KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d476516040b1c6c4c035ae0600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d476516040b1c6c4c035ae0600.jpg 2.85KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~1c8eabee1451d1c68de7854cc300.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~1c8eabee1451d1c68de7854cc300.jpg 1.85KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d37f9141c181c6c9fd2cabc000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d37f9141c181c6c9fd2cabc000.jpg 2.22KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d42a113125d1c6c53d1c4f600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d42a113125d1c6c53d1c4f600.jpg 2.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d474c14c4321c6c45ddcad8600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d474c14c4321c6c45ddcad8600.jpg 2.25KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2660e312c1abe1c67c419750a100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2660e312c1abe1c67c419750a100.jpg 2.48KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2910bb2b9000361c4e85e63135e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2910bb2b9000361c4e85e63135e00.jpg 2.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d429a12aaae1c6c6cf10431700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d429a12aaae1c6c6cf10431700.jpg 1.37KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d42b4123fb21c6c941abdbbe00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d42b4123fb21c6c941abdbbe00.jpg 1.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d476416e2e11c6c4bf94bf4b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d476416e2e11c6c4bf94bf4b00.jpg 2.53KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d4289178ed61c6c631fa334900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d4289178ed61c6c631fa334900.jpg 2.97KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d429a1667951c6c9f564af0500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d429a1667951c6c9f564af0500.jpg 2.61KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d42ae17d5231c6c6f08dcb4f00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d42ae17d5231c6c6f08dcb4f00.jpg 1.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42891267691c6c632847bad00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42891267691c6c632847bad00.jpg 2.54KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42ae1544511c6c8679eea9c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42ae1544511c6c8679eea9c00.jpg 1.87KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42b3124aa21c6c667f8847800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42b3124aa21c6c667f8847800.jpg 2.39KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d474a1649621c6c528d6d0a700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d474a1649621c6c528d6d0a700.jpg 2.25KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47631178621c6c45d3e212500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47631178621c6c45d3e212500.jpg 1.60KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47671348a01c6c45496075e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47671348a01c6c45496075e00.jpg 1.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d477e1644cf1c6c4af93dbe00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d477e1644cf1c6c4af93dbe00.jpg 2.31KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3860e30ea641b1c67c41928bed00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3860e30ea641b1c67c41928bed00.jpg 2.07KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3f5d42bd13ef971c6c629cce29d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~3f5d42bd13ef971c6c629cce29d00.jpg 2.56KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4260e30e827d41c67c4190299300.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4260e30e827d41c67c4190299300.jpg 2.19KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d429b13cf431c6c9fccaeb5600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d429b13cf431c6c9fccaeb5600.jpg 2.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d42af1651b11c6c6f359a7900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d42af1651b11c6c6f359a7900.jpg 2.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d474b14a6f81c6c526c6b7c800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d474b14a6f81c6c526c6b7c800.jpg 2.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d4766156df31c6c45482f48e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d4766156df31c6c45482f48e00.jpg 1.96KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~455d42bd147f351c6c62142963b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~455d42bd147f351c6c62142963b00.jpg 2.41KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~460e30e887e21c67c41961f7400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~460e30e887e21c67c41961f7400.jpg 2.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4758eb0a3b81c64bd212f68900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4758eb0a3b81c64bd212f68900.jpg 1.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~495d42bc1592711c6c629d79d3200.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~495d42bc1592711c6c629d79d3200.jpg 2.23KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4e60e30f74b291c67c4194ee4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~4e60e30f74b291c67c4194ee4700.jpg 2.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5060e312cd8b71c67c419c155500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5060e312cd8b71c67c419c155500.jpg 2.12KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d429b15a59c1c6c98bd9e5f000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d429b15a59c1c6c98bd9e5f000.jpg 2.35KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42af1565c21c6c6ebea783b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42af1565c21c6c6ebea783b00.jpg 2.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42b6132ae41c6c6328a718e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42b6132ae41c6c6328a718e00.jpg 2.75KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~575d42a1172aff1c6c5691ae39c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~575d42a1172aff1c6c5691ae39c00.jpg 2.40KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d429b1426a71c6c9ef81e0d500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d429b1426a71c6c9ef81e0d500.jpg 2.10KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d42af15858d1c6c6ed80f92c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d42af15858d1c6c6ed80f92c00.jpg 2.03KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d474b16af5e1c6c4c9b7eef800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d474b16af5e1c6c4c9b7eef800.jpg 2.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d42b5142a761c6c86c71ecb800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d42b5142a761c6c86c71ecb800.jpg 1.70KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d474b15725f1c6c4a88580d300.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d474b15725f1c6c4a88580d300.jpg 1.32KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6660e327bd5c71c67c419fa8dc00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6660e327bd5c71c67c419fa8dc00.jpg 2.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6860e31381e411c67c419881ce00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6860e31381e411c67c419881ce00.jpg 2.16KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d42a013a9751c6c53d13a69900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d42a013a9751c6c53d13a69900.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d474d14395a1c6c49422854100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d474d14395a1c6c49422854100.jpg 2.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7060e30f8450f1c67c41961f7400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7060e30f8450f1c67c41961f7400.jpg 2.70KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~735d42bc145b891c6c62a42e70400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~735d42bc145b891c6c62a42e70400.jpg 2.60KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7460e30fc12d41c67c4194ee4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7460e30fc12d41c67c4194ee4700.jpg 2.02KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d428817179f1c6c62fea1a6a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d428817179f1c6c62fea1a6a00.jpg 2.44KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d429b1444e81c6c9ef87d6b600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d429b1444e81c6c9ef87d6b600.jpg 1.83KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d42af1714a41c6c6eff0701b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d42af1714a41c6c6eff0701b00.jpg 1.84KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d474b13f0761c6c4ca3c417b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d474b13f0761c6c4ca3c417b00.jpg 2.05KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d429c1499a11c6c6ceb2163400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d429c1499a11c6c6ceb2163400.jpg 1.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d42a116d3df1c6c600ede2c800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d42a116d3df1c6c600ede2c800.jpg 2.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~83601b0fe1f1c6e8b8a23a6400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~83601b0fe1f1c6e8b8a23a6400.jpg 2.89KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~8460e312d5bf51c67c419d468200.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~8460e312d5bf51c67c419d468200.jpg 2.09KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d42b5144e6f1c6c87a8a63cf00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d42b5144e6f1c6c87a8a63cf00.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d476517a0241c6c4bf7a856d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d476517a0241c6c4bf7a856d00.jpg 2.18KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~895d42b416f62a1c6c95d9b394100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~895d42b416f62a1c6c95d9b394100.jpg 1.85KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~92f49662148f41c6e8b87fa84b00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~92f49662148f41c6e8b87fa84b00.jpg 3.60KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d4289154c441c6c6318349a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d4289154c441c6c6318349a00.jpg 2.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d42ae1760021c6c6f086a44100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d42ae1760021c6c6f086a44100.jpg 2.03KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42af1424a71c6c6f094f25d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42af1424a71c6c6f094f25d00.jpg 1.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42b212e2cf1c6c664531bd500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42b212e2cf1c6c664531bd500.jpg 2.21KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d474b1290971c6c4ced4d9fa00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d474b1290971c6c4ced4d9fa00.jpg 2.28KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d476213e6031c6c45d2053c000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d476213e6031c6c45d2053c000.jpg 1.89KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d477f15bdfc1c6c4aef88d4800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d477f15bdfc1c6c4aef88d4800.jpg 2.38KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9860e312a46ed1c67c4199b2fb00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9860e312a46ed1c67c4199b2fb00.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d429c14a9641c6c6c75b592c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d429c14a9641c6c6c75b592c00.jpg 1.66KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d42a1139dfa1c6c54773a23d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d42a1139dfa1c6c54773a23d00.jpg 1.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d474c14db371c6c4a22f51500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d474c14db371c6c4a22f51500.jpg 2.11KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~a15d42bd10a8cc1c6c62130b49800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~a15d42bd10a8cc1c6c62130b49800.jpg 2.42KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d429a1108731c6c9ee485b9a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d429a1108731c6c9ee485b9a00.jpg 1.43KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42ae168b741c6c6ed7c347800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42ae168b741c6c6ed7c347800.jpg 2.13KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b310713a1c6c662e2c08400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b310713a1c6c662e2c08400.jpg 1.77KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b711f4ad1c6c63426e86000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b711f4ad1c6c63426e86000.jpg 2.30KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d429a1454fb1c6c6d052208d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d429a1454fb1c6c6d052208d00.jpg 1.47KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d476416c1b01c6c4c0321a7f00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d476416c1b01c6c4c0321a7f00.jpg 2.68KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d429a15a9771c6c6e15d2fe900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d429a15a9771c6c6e15d2fe900.jpg 2.34KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d42b41653cf1c6c984bc615800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d42b41653cf1c6c984bc615800.jpg 2.45KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d476415ea531c6c4c03cd51400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d476415ea531c6c4c03cd51400.jpg 2.96KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b860e312c14211c67c4199b2fb00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~b860e312c14211c67c4199b2fb00.jpg 2.32KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d429c16756a1c6c6cae687f100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d429c16756a1c6c6cae687f100.jpg 2.41KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d42a115cee91c6c5477866f100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d42a115cee91c6c5477866f100.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d474c16efb11c6c4a2cb3a9d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d474c16efb11c6c4a2cb3a9d00.jpg 2.59KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c260e312a151a1c67c419881ce00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c260e312a151a1c67c419881ce00.jpg 2.77KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d429b17af651c6c6d5ee995e00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d429b17af651c6c6d5ee995e00.jpg 2.29KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d4765147a821c6c4c039418d00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d4765147a821c6c4c039418d00.jpg 3.15KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c55d37f91500681c6c9fd44834400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c55d37f91500681c6c9fd44834400.jpg 2.51KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d429d159d371c6c6cccfa5c00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d429d159d371c6c6cccfa5c00.jpg 2.30KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d42a01715711c6c5477d2ba500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d42a01715711c6c5477d2ba500.jpg 2.23KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d474d1351fa1c6c4a82c18a400.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d474d1351fa1c6c4a82c18a400.jpg 1.55KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ce60e313c173f1c67c419ae42800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ce60e313c173f1c67c419ae42800.jpg 1.91KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d060e30e6d6201c67c4194ee4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d060e30e6d6201c67c4194ee4700.jpg 2.27KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d75d42bd172dcb1c6c62a47abb800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~d75d42bd172dcb1c6c62a47abb800.jpg 2.69KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF1FC3.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF20F2.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF2587.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF26.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF27FE.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF331E.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF3870.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF3D4D.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF43B3.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF47F2.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF517B.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF58E.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF5B86.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d42b5153d731c6c95d7fce3600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d42b5153d731c6c95d7fce3600.jpg 2.32KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d474b16beb91c6c4abd3e3a100.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d474b16beb91c6c4abd3e3a100.jpg 2.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d476516717a1c6c4c0157e4700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d476516717a1c6c4c0157e4700.jpg 2.24KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF6C73.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF6CA4.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9434.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9815.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9E8F.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFA783.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFAD36.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFB848.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFC0BF.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFC187.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFCF25.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD17B.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD285.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD58A.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFDA34.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFDE06.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFE320.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFEA41.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFFD54.tmp 0.11MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d428817184b1c6c62fb2132700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d428817184b1c6c62fb2132700.jpg 2.51KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d42af15795a1c6c6e992d8d000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d42af15795a1c6c6e992d8d000.jpg 2.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d474b1418a81c6c4c0478fa900.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d474b1418a81c6c4c0478fa900.jpg 2.63KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d476211c54e1c6c454a586a700.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d476211c54e1c6c454a586a700.jpg 1.86KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e860e30fc7e161c67c4193bd1a00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~e860e30fc7e161c67c4193bd1a00.jpg 1.98KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ef5d42bc1428401c6c625960a8800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ef5d42bc1428401c6c625960a8800.jpg 2.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f35d474d1380b11c6c4a84b173600.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f35d474d1380b11c6c4a84b173600.jpg 1.37KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f460e313aa9b71c67c419ae42800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f460e313aa9b71c67c419ae42800.jpg 2.04KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d429d11adb51c6c6ced3772000.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d429d11adb51c6c6ced3772000.jpg 1.46KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d474d13f0c11c6c4a880bc1f00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d474d13f0c11c6c4a880bc1f00.jpg 2.29KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d429b143dd71c6c6cf2bae2200.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d429b143dd71c6c6cf2bae2200.jpg 1.43KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d42b516e7631c6c95d8bb9f800.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d42b516e7631c6c95d8bb9f800.jpg 2.66KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d474b155b991c6c4abd8a85500.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d474b155b991c6c4abd8a85500.jpg 2.31KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d4765165c881c6c4c01911ce00.jpd 21 bytes
C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d4765165c881c6c4c01911ce00.jpg 2.95KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRD0000.doc 5.90KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRD0001.doc 18.42KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF0000.tmp 1.09MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF0001.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF1229.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF1538.tmp 16.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF3741.tmp 2.80MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRL0827.tmp 42.00KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRL2214.tmp 51.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0000.tmp 14.67KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0001.tmp 0.25MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0002.tmp 0.19MB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0003.tmp 44.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0004.tmp 91.65KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0005.tmp 15.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0006.tmp 12.17KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0007.tmp 3.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0281.tmp 100.20KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0491.tmp 82.50KB
C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS3757.tmp 0.54MB
C:\WINDOWS\MiniDump\Mini032905-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini042506-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042506-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042606-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042606-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini042706-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052105-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052106-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052106-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052106-03.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini052606-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini080905-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini082405-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini082405-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini092105-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini092105-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini092905-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100105-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini100205-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100205-02.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100705-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100805-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini100805-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini101005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini101605-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini101705-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini102005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102105-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102105-02.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102205-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102305-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini102305-02.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini102305-03.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102305-04.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102405-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102505-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini102605-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini110605-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini110705-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini111005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini111005-02.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini111005-03.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini112105-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini113005-01.dmp 88.00KB
C:\WINDOWS\MiniDump\Mini120605-01.dmp 64.00KB
C:\WINDOWS\MiniDump\Mini121905-01.dmp 64.00KB
C:\WINDOWS\system32\wbem\Logs\FrameWork.log 65.29KB
C:\WINDOWS\system32\wbem\Logs\mofcomp.log 3.58KB
C:\WINDOWS\system32\wbem\Logs\NTEVT.log 2 bytes
C:\WINDOWS\system32\wbem\Logs\replog.log 401 bytes
C:\WINDOWS\system32\wbem\Logs\setup.log 653 bytes
C:\WINDOWS\system32\wbem\Logs\wbemess.log 52.75KB
C:\WINDOWS\system32\wbem\Logs\wbemprox.log 1.93KB
C:\WINDOWS\system32\wbem\Logs\WBEMSNMP.log 2 bytes
C:\WINDOWS\system32\wbem\Logs\WinMgmt.log 12.71KB
C:\WINDOWS\system32\wbem\Logs\wmiadap.log 2.35KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.log 29.99KB
C:\WINDOWS\system32\wbem\Logs\wbemess.lo_ 64.00KB
C:\WINDOWS\system32\wbem\Logs\wmiprov.lo_ 64.03KB
C:\WINDOWS.log 0 bytes
C:\WINDOWS\cmsetacl.log 200 bytes
C:\WINDOWS\comsetup.log 0.29MB
C:\WINDOWS\dahotfix.log 17.96KB
C:\WINDOWS\DirectX.log 74.09KB
C:\WINDOWS\DtcInstall.log 115 bytes
C:\WINDOWS\FaxSetup.log 1.05MB
C:\WINDOWS\iis6.log 0.17MB
C:\WINDOWS\imsins.log 1.34KB
C:\WINDOWS\KB810217.log 15.05KB
C:\WINDOWS\KB821557.log 10.39KB
C:\WINDOWS\KB823182.log 13.13KB
C:\WINDOWS\KB823559.log 11.09KB
C:\WINDOWS\KB823980.log 11.70KB
C:\WINDOWS\KB824105.log 10.48KB
C:\WINDOWS\KB824141.log 9.01KB
C:\WINDOWS\KB824146.log 12.11KB
C:\WINDOWS\KB825119.log 11.73KB
C:\WINDOWS\KB828028.log 3.55KB
C:\WINDOWS\KB828035.log 8.78KB
C:\WINDOWS\KB828741.log 9.05KB
C:\WINDOWS\KB833987.log 3.35KB
C:\WINDOWS\KB834707.log 7.55KB
C:\WINDOWS\KB835732.log 68.45KB
C:\WINDOWS\KB837001.log 4.79KB
C:\WINDOWS\KB839643-DirectX9.log 2.64KB
C:\WINDOWS\KB839643.log 2.72KB
C:\WINDOWS\KB839645.log 6.08KB
C:\WINDOWS\KB840315.log 5.17KB
C:\WINDOWS\KB840374.log 16.76KB
C:\WINDOWS\KB841873.log 7.28KB
C:\WINDOWS\KB842773.log 5.21KB
C:\WINDOWS\KB867282.log 12.43KB
C:\WINDOWS\KB873333.log 12.64KB
C:\WINDOWS\KB873339.log 0.10MB
C:\WINDOWS\KB883357.log 2.92KB
C:\WINDOWS\KB883939.log 16.69KB
C:\WINDOWS\KB885250.log 16.26KB
C:\WINDOWS\KB885835.log 0.11MB
C:\WINDOWS\KB885836.log 0.10MB
C:\WINDOWS\KB886185.log 0.10MB
C:\WINDOWS\KB887472.log 15.23KB
C:\WINDOWS\KB887742.log 9.46KB
C:\WINDOWS\KB888113.log 15.96KB
C:\WINDOWS\KB888302.log 9.81KB
C:\WINDOWS\KB890046.log 11.29KB
C:\WINDOWS\KB890047.log 10.63KB
C:\WINDOWS\KB890175.log 43.83KB
C:\WINDOWS\KB890859.log 88.92KB
C:\WINDOWS\KB890923.log 91.64KB
C:\WINDOWS\KB891781.log 15.32KB
C:\WINDOWS\KB893066.log 100.19KB
C:\WINDOWS\KB893086.log 87.57KB
C:\WINDOWS\KB893756.log 18.32KB
C:\WINDOWS\KB893803.log 47.30KB
C:\WINDOWS\KB893803v2.log 9.53KB
C:\WINDOWS\KB894391.log 12.82KB
C:\WINDOWS\KB896358.log 11.48KB
C:\WINDOWS\KB896422.log 15.32KB
C:\WINDOWS\KB896423.log 17.62KB
C:\WINDOWS\KB896424.log 11.66KB
C:\WINDOWS\KB896428.log 10.00KB
C:\WINDOWS\KB896688.log 14.25KB
C:\WINDOWS\KB896727.log 18.65KB
C:\WINDOWS\KB898458.log 5.04KB
C:\WINDOWS\KB898461.log 6.72KB
C:\WINDOWS\KB899587.log 18.64KB
C:\WINDOWS\KB899588.log 13.15KB
C:\WINDOWS\KB899591.log 18.21KB
C:\WINDOWS\KB900485.log 11.02KB
C:\WINDOWS\KB900725.log 13.18KB
C:\WINDOWS\KB901017.log 20.46KB
C:\WINDOWS\KB901214.log 9.72KB
C:\WINDOWS\KB902400.log 23.33KB
C:\WINDOWS\KB903235.log 3.74KB
C:\WINDOWS\KB904706.log 10.85KB
C:\WINDOWS\KB905414.log 13.16KB
C:\WINDOWS\KB905749.log 11.54KB
C:\WINDOWS\KB905915.log 16.07KB
C:\WINDOWS\KB908519.log 9.90KB
C:\WINDOWS\KB908531.log 17.86KB
C:\WINDOWS\KB910437.log 9.67KB
C:\WINDOWS\KB911280.log 15.94KB
C:\WINDOWS\KB911562.log 17.04KB
C:\WINDOWS\KB911564.log 8.48KB
C:\WINDOWS\KB911565.log 8.38KB
C:\WINDOWS\KB911567.log 13.10KB
C:\WINDOWS\KB911927.log 10.51KB
C:\WINDOWS\KB912812.log 19.50KB
C:\WINDOWS\KB912919.log 10.85KB
C:\WINDOWS\KB913446.log 6.49KB
C:\WINDOWS\KB913580.log 17.76KB
C:\WINDOWS\KB914388.log 11.97KB
C:\WINDOWS\KB914389.log 11.32KB
C:\WINDOWS\KB916281.log 18.70KB
C:\WINDOWS\KB916595.log 10.17KB
C:\WINDOWS\KB917159.log 11.49KB
C:\WINDOWS\KB917344.log 16.99KB
C:\WINDOWS\KB917422.log 11.64KB
C:\WINDOWS\KB917734.log 14.72KB
C:\WINDOWS\KB917953.log 15.96KB
C:\WINDOWS\KB918118.log 15.54KB
C:\WINDOWS\KB918439.log 16.31KB
C:\WINDOWS\KB918899.log 20.69KB
C:\WINDOWS\KB919007.log 12.90KB
C:\WINDOWS\KB920213.log 24.23KB
C:\WINDOWS\KB920214.log 17.53KB
C:\WINDOWS\KB920670.log 12.28KB
C:\WINDOWS\KB920683.log 11.91KB
C:\WINDOWS\KB920685.log 12.75KB
C:\WINDOWS\KB920872.log 14.51KB
C:\WINDOWS\KB921398.log 18.02KB
C:\WINDOWS\KB921883.log 13.19KB
C:\WINDOWS\KB922582.log 8.97KB
C:\WINDOWS\KB922616.log 17.52KB
C:\WINDOWS\KB922760.log 25.76KB
C:\WINDOWS\KB922819.log 17.22KB
C:\WINDOWS\KB923191.log 13.01KB
C:\WINDOWS\KB923414.log 15.46KB
C:\WINDOWS\KB923689.log 11.38KB
C:\WINDOWS\KB923694.log 11.90KB
C:\WINDOWS\KB923723.log 9.08KB
C:\WINDOWS\KB923980.log 24.65KB
C:\WINDOWS\KB924191.log 17.57KB
C:\WINDOWS\KB924270.log 24.82KB
C:\WINDOWS\KB924496.log 15.45KB
C:\WINDOWS\KB924667.log 13.34KB
C:\WINDOWS\KB925398.log 10.38KB
C:\WINDOWS\KB925454.log 29.48KB
C:\WINDOWS\KB925486.log 12.08KB
C:\WINDOWS\KB926255.log 11.90KB
C:\WINDOWS\KB926436.log 15.25KB
C:\WINDOWS\KB927779.log 19.40KB
C:\WINDOWS\KB927802.log 16.27KB
C:\WINDOWS\KB928090.log 19.15KB
C:\WINDOWS\KB928255.log 16.80KB
C:\WINDOWS\KB928843.log 10.35KB
C:\WINDOWS\KB929338.log 11.78KB
C:\WINDOWS\KB929969.log 10.35KB
C:\WINDOWS\KB931836.log 25.53KB
C:\WINDOWS\msgsocm.log 54.15KB
C:\WINDOWS\nsw.log 489 bytes
C:\WINDOWS\ntdtcsetup.log 0.22MB
C:\WINDOWS\ocgen.log 0.41MB
C:\WINDOWS\ocmsn.log 52.27KB
C:\WINDOWS\Q306583.log 1.31KB
C:\WINDOWS\Q308402.log 4.20KB
C:\WINDOWS\Q308678.log 1.20KB
C:\WINDOWS\Q309521.log 7.85KB
C:\WINDOWS\Q311889.log 4.54KB
C:\WINDOWS\Q311967.log 5.80KB
C:\WINDOWS\Q312368.log 1.76KB
C:\WINDOWS\Q312370.log 3.89KB
C:\WINDOWS\Q313450.log 7.39KB
C:\WINDOWS\Q314147.log 5.85KB
C:\WINDOWS\Q314412.log 944 bytes
C:\WINDOWS\Q314862.log 5.79KB
C:\WINDOWS\Q315000.log 3.24KB
C:\WINDOWS\Q315403.log 2.35KB
C:\WINDOWS\Q317277.log 6.10KB
C:\WINDOWS\Q318138.log 7.12KB
C:\WINDOWS\Q319580.log 7.14KB
C:\WINDOWS\Q323172.log 7.70KB
C:\WINDOWS\Q323255.log 8.31KB
C:\WINDOWS\Q324096.log 8.32KB
C:\WINDOWS\Q324380.log 7.64KB
C:\WINDOWS\Q326147.log 4.17KB
C:\WINDOWS\Q326830.log 8.27KB
C:\WINDOWS\Q328310.log 11.11KB
C:\WINDOWS\Q328940.log 4.20KB
C:\WINDOWS\Q329048.log 8.27KB
C:\WINDOWS\Q329115.log 9.17KB
C:\WINDOWS\Q329170.log 11.07KB
C:\WINDOWS\Q329390.log 8.27KB
C:\WINDOWS\Q329441.log 12.74KB
C:\WINDOWS\Q329834.log 1.57KB
C:\WINDOWS\Q331953.log 23.58KB
C:\WINDOWS\Q810577.log 15.61KB
C:\WINDOWS\Q811493.log 19.24KB
C:\WINDOWS\Q811630.log 19.31KB
C:\WINDOWS\Q815021.log 12.49KB
C:\WINDOWS\Q817606.log 11.53KB
C:\WINDOWS\Q819696.log 11.23KB
C:\WINDOWS\Q828026.log 12.46KB
C:\WINDOWS\regopt.log 3.34KB
C:\WINDOWS\sessmgr.setup.log 3.55KB
C:\WINDOWS\setupact.log 4.64KB
C:\WINDOWS\setupapi.log 0.63MB
C:\WINDOWS\setuperr.log 0 bytes
C:\WINDOWS\spupdsvc.log 30.32KB
C:\WINDOWS\Sti_Trace.log 0 bytes
C:\WINDOWS\svcpack.log 0.49MB
C:\WINDOWS\tsoc.log 0.41MB
C:\WINDOWS\updspapi.log 55.10KB
C:\WINDOWS\vminst.log 2.00KB
C:\WINDOWS\WGA.log 8.30KB
C:\WINDOWS\wiadebug.log 216 bytes
C:\WINDOWS\wiaservc.log 50 bytes
C:\WINDOWS\Windows Update.log 0.20MB
C:\WINDOWS\wmsetup.log 79.27KB
C:\WINDOWS\xpsp1hfm.log 0.15MB
C:\WINDOWS\yacs.log 392 bytes
C:\WINDOWS\imsins.BAK 1.34KB
C:\WINDOWS\IE4 Error Log.txt 240 bytes
C:\WINDOWS\ntbtlog.txt 76.26KB
C:\WINDOWS\OEWABLog.txt 345 bytes
C:\WINDOWS\ReportMaker Plus Setup Log.txt 180 bytes
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log 44.3MB
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp 53.16KB
C:\WINDOWS\Debug\blastcln.log 286 bytes
C:\WINDOWS\Debug\mrt.log 18.64KB
C:\WINDOWS\Debug\NetSetup.LOG 6.91KB
C:\WINDOWS\security\logs\backup.log 2.87KB
C:\WINDOWS\security\logs\convert.log 3.37KB
C:\WINDOWS\security\logs\SceRoot.log 216 bytes
C:\WINDOWS\security\logs\scesetup.log 0.11MB
C:\WINDOWS\security\logs\scesrv.log 526 bytes
C:\WINDOWS\security\logs\update.log 6.99KB
C:\WINDOWS\security\logs\scecomp.old 2.42KB
------------------------------------------------------------------------------------------
Sadly, no.
A window still pops up upon statrup that says my homepage is trying to be changed to messengersite.net
And HiJackThis still shuts down within seconds of starting.
Tricky Tricky eh?
Regards,
Jason
A window still pops up upon statrup that says my homepage is trying to be changed to messengersite.net
And HiJackThis still shuts down within seconds of starting.
Tricky Tricky eh?
Regards,
Jason
Hi,Jason86
Hmm without seeing a HijackThis, let's try something here
Please Download MsnVirRem.exe to your desktop from one of the following mirrors.
Mirror 1
Mirror 2
First close any other programs you have running as this will require a reboot
Double click MsnVirRem.exe to run it
Once open, click the button labelled "Search and Destroy"
<<Your computer will now be scanned for Infected Files>>
When scanning is finished you will be prompted to reboot only if infected, Click OK
Now click the "REBOOT" Button.
After the Reboot, you WILL receive file not found errors (usually 4) please acknowledge them and continue.
A Message should popup from MsnVirRem if not, double click the program again and it will finish
Please Post the contents of C:\msnvirrem.log along with a fresh HijackThis log
--------------
Also run this tool for me as well.
Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.
Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
---------------
Then come back here with all logfiles.
Gogo
Hmm without seeing a HijackThis, let's try something here
Please Download MsnVirRem.exe to your desktop from one of the following mirrors.
Mirror 1
Mirror 2
First close any other programs you have running as this will require a reboot
Double click MsnVirRem.exe to run it
Once open, click the button labelled "Search and Destroy"
<<Your computer will now be scanned for Infected Files>>
When scanning is finished you will be prompted to reboot only if infected, Click OK
Now click the "REBOOT" Button.
After the Reboot, you WILL receive file not found errors (usually 4) please acknowledge them and continue.
A Message should popup from MsnVirRem if not, double click the program again and it will finish
Please Post the contents of C:\msnvirrem.log along with a fresh HijackThis log
--------------
Also run this tool for me as well.
Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.
Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
---------------
Then come back here with all logfiles.
Gogo
"Jason" - 07-03-24 12:42:46 Service Pack 2
ComboFix 07-03-23 - Running from: "C:\Documents and Settings\Jason\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\taskkill.com
((((((((((((((((((((((((((((((( Files Created from 2007-02-24 to 2007-03-24 ))))))))))))))))))))))))))))))))))
2007-03-23 11:51 <DIR> d-------- C:\Program Files\CCleaner
2007-03-23 02:14 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-03-23 02:14 <DIR> d-------- C:\DOCUME~1\Jason\APPLIC~1\SUPERAntiSpyware.com
2007-03-23 02:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-03-21 23:59 <DIR> d-------- C:\HJT
2007-03-20 17:06 <DIR> d-------- C:\DOCUME~1\Jason\APPLIC~1\Lavasoft
2007-03-08 16:14 <DIR> d--hs---- C:\WINDOWS\system32\nsgmgvmq
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-03-23 11:40 -------- d-------- C:\Program Files\hbinst
2007-03-23 02:13 -------- d-------- C:\Program Files\Common Files\wise installation wizard
2007-03-20 18:36 -------- d--h----- C:\Program Files\sysai
2007-03-20 18:36 -------- d-------- C:\Program Files\gramuser
2007-03-20 17:06 -------- d-------- C:\Program Files\lavasoft
2007-03-14 19:30 -------- d-------- C:\Program Files\messenger
2007-03-08 16:25 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
@=""
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"EPSON Stylus C84 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2D1.EXE /P23 \"EPSON Stylus C84 Series\" /M \"Stylus C84\" /EF \"HKCU\""
"Free Download Manager"="C:\\Program Files\\Free Download Manager\\fdm.exe -autorun"
"csrss"=""
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe"
"EPSON Stylus C84 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2D1.EXE /P23 \"EPSON Stylus C84 Series\" /O6 \"USB001\" /M \"Stylus C84\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe"
"MoneyStartUp10.0"="\"c:\\Program Files\\Microsoft Money\\System\\Activation.exe\""
"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"
"OrderReminder"="C:\\Program Files\\Hewlett-Packard\\OrderReminder\\OrderReminder.exe"
"csrss"=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\Compaq]
"SetRefresh"="C:\\Program Files\\Compaq\\SetRefresh\\SetRefresh.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"="1"
"NoAdminPage"="1"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService REG_MULTI_SZ DnsCache\
rpcss REG_MULTI_SZ RpcSs\
imgsvc REG_MULTI_SZ StiSvc\
termsvcs REG_MULTI_SZ TermService\
HTTPFilter REG_MULTI_SZ HTTPFilter\
DcomLaunch REG_MULTI_SZ DcomLaunchTermService\
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_NMSCFG
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Registration reminder 1.job
C:\WINDOWS\tasks\Registration reminder 2.job
C:\WINDOWS\tasks\Registration reminder 3.job
********************************************************************
catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
EPSON Stylus C84 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"???????>???_???????o????????????a?w&????????????????????????????????????b?w????????????????8???????????h??w????????????z??w????????????)??|???????
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EPSON Stylus C84 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"???????>???_???????o????????????a?w&????????????????????????????????????b?w????????????????8???????????h??w????????????z??w????????????)??|???????
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-03-24 12:50:46
ComboFix 07-03-23 - Running from: "C:\Documents and Settings\Jason\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\taskkill.com
((((((((((((((((((((((((((((((( Files Created from 2007-02-24 to 2007-03-24 ))))))))))))))))))))))))))))))))))
2007-03-23 11:51 <DIR> d-------- C:\Program Files\CCleaner
2007-03-23 02:14 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-03-23 02:14 <DIR> d-------- C:\DOCUME~1\Jason\APPLIC~1\SUPERAntiSpyware.com
2007-03-23 02:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-03-21 23:59 <DIR> d-------- C:\HJT
2007-03-20 17:06 <DIR> d-------- C:\DOCUME~1\Jason\APPLIC~1\Lavasoft
2007-03-08 16:14 <DIR> d--hs---- C:\WINDOWS\system32\nsgmgvmq
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-03-23 11:40 -------- d-------- C:\Program Files\hbinst
2007-03-23 02:13 -------- d-------- C:\Program Files\Common Files\wise installation wizard
2007-03-20 18:36 -------- d--h----- C:\Program Files\sysai
2007-03-20 18:36 -------- d-------- C:\Program Files\gramuser
2007-03-20 17:06 -------- d-------- C:\Program Files\lavasoft
2007-03-14 19:30 -------- d-------- C:\Program Files\messenger
2007-03-08 16:25 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
@=""
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"EPSON Stylus C84 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2D1.EXE /P23 \"EPSON Stylus C84 Series\" /M \"Stylus C84\" /EF \"HKCU\""
"Free Download Manager"="C:\\Program Files\\Free Download Manager\\fdm.exe -autorun"
"csrss"=""
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe"
"EPSON Stylus C84 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2D1.EXE /P23 \"EPSON Stylus C84 Series\" /O6 \"USB001\" /M \"Stylus C84\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe"
"MoneyStartUp10.0"="\"c:\\Program Files\\Microsoft Money\\System\\Activation.exe\""
"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"
"OrderReminder"="C:\\Program Files\\Hewlett-Packard\\OrderReminder\\OrderReminder.exe"
"csrss"=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\Compaq]
"SetRefresh"="C:\\Program Files\\Compaq\\SetRefresh\\SetRefresh.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"="1"
"NoAdminPage"="1"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService REG_MULTI_SZ DnsCache\
rpcss REG_MULTI_SZ RpcSs\
imgsvc REG_MULTI_SZ StiSvc\
termsvcs REG_MULTI_SZ TermService\
HTTPFilter REG_MULTI_SZ HTTPFilter\
DcomLaunch REG_MULTI_SZ DcomLaunchTermService\
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_NMSCFG
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Registration reminder 1.job
C:\WINDOWS\tasks\Registration reminder 2.job
C:\WINDOWS\tasks\Registration reminder 3.job
********************************************************************
catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
EPSON Stylus C84 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"???????>???_???????o????????????a?w&????????????????????????????????????b?w????????????????8???????????h??w????????????z??w????????????)??|???????
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EPSON Stylus C84 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"???????>???_???????o????????????a?w&????????????????????????????????????b?w????????????????8???????????h??w????????????z??w????????????)??|???????
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-03-24 12:50:46
MSNVirRem.exe closes in seconds just like HiJackThis still does.
Hi,Jason86
Download The Avenger Copyright © Swandog46
You must extract avenger.exe to your desktop, before you run it.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Copy all the text contained in the code box below to your Clipboard.
NOTE: don't copy the word quote
The above script is for this user only, if you need help please start your own thread.
Start the Avenger.
Under "Script file to execute" choose "Input Script Manually".
Click on the Magnifying Glass icon which will open a new window titled "View/edit script".
Paste the entire text in into this window.
Click done, now click on the Green Light
Answer "Yes" twice when prompted.
Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.
After the restart, it will create a log file that should open.
This log file will be located at C:\avenger.txt
Paste the contents of C:\avenger.txt into your reply along with a fresh HijackThis! log.
Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.
----------------
Then after reboot see if you can run this tool here.
Download to your desktop http://www.malekal.com/download/clean.zip, and right click to allow it to create it's own "clean" folder. In that folder click on clean.cmd. When the command window (black screen) opens select option 1 (and Enter). Allow the scan to complete, press any key and post the contents of the text popup back here please.
----------------
Then come back here with all logfiles.
Gogo
Download The Avenger Copyright © Swandog46
You must extract avenger.exe to your desktop, before you run it.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Copy all the text contained in the code box below to your Clipboard.
NOTE: don't copy the word quote
QUOTE
Files to delete:
C:\WINDOWS\system32\nsgmgvmq
C:\Program Files\hbinst
C:\Program Files\sysai
C:\WINDOWS\system32\nsgmgvmq
C:\Program Files\hbinst
C:\Program Files\sysai
The above script is for this user only, if you need help please start your own thread.
Start the Avenger.
Under "Script file to execute" choose "Input Script Manually".
Click on the Magnifying Glass icon which will open a new window titled "View/edit script".
Paste the entire text in into this window.
Click done, now click on the Green Light
Answer "Yes" twice when prompted.
Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.
After the restart, it will create a log file that should open.
This log file will be located at C:\avenger.txt
Paste the contents of C:\avenger.txt into your reply along with a fresh HijackThis! log.
Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.
----------------
Then after reboot see if you can run this tool here.
Download to your desktop http://www.malekal.com/download/clean.zip, and right click to allow it to create it's own "clean" folder. In that folder click on clean.cmd. When the command window (black screen) opens select option 1 (and Enter). Allow the scan to complete, press any key and post the contents of the text popup back here please.
----------------
Then come back here with all logfiles.
Gogo
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\cxwmxtqe
*******************
Script file located at: \??\C:\tbsarpjh.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Error: C:\WINDOWS\system32\nsgmgvmq is a folder, not a file!
Deletion of file C:\WINDOWS\system32\nsgmgvmq failed!
Could not process line:
C:\WINDOWS\system32\nsgmgvmq
Status: 0xc00000ba
Error: C:\Program Files\hbinst is a folder, not a file!
Deletion of file C:\Program Files\hbinst failed!
Could not process line:
C:\Program Files\hbinst
Status: 0xc00000ba
Error: C:\Program Files\sysai is a folder, not a file!
Deletion of file C:\Program Files\sysai failed!
Could not process line:
C:\Program Files\sysai
Status: 0xc00000ba
Completed script processing.
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le 25/03/2007 a 6:10:10.34
*** Recherche de fichiers sur C:
*** Recherche des fichiers dans C:\WINDOWS\
*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\System32\taskkill.com FOUND
C:\WINDOWS\System32\netstat.com FOUND
C:\WINDOWS\system32\f3PSSavr.scr FOUND
"C:\Program Files\funwebproducts\" FOUND
"C:\Program Files\hbinst\" FOUND
"C:\Program Files\msn messenger\riched20.dll" FOUND
"C:\Program Files\MyWebSearch\" FOUND
*** Fin du rapport !
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\cxwmxtqe
*******************
Script file located at: \??\C:\tbsarpjh.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Error: C:\WINDOWS\system32\nsgmgvmq is a folder, not a file!
Deletion of file C:\WINDOWS\system32\nsgmgvmq failed!
Could not process line:
C:\WINDOWS\system32\nsgmgvmq
Status: 0xc00000ba
Error: C:\Program Files\hbinst is a folder, not a file!
Deletion of file C:\Program Files\hbinst failed!
Could not process line:
C:\Program Files\hbinst
Status: 0xc00000ba
Error: C:\Program Files\sysai is a folder, not a file!
Deletion of file C:\Program Files\sysai failed!
Could not process line:
C:\Program Files\sysai
Status: 0xc00000ba
Completed script processing.
Rapport clean par Malekal_morte - http://www.malekal.com
Option 1, executee le 25/03/2007 a 6:10:10.34
*** Recherche de fichiers sur C:
*** Recherche des fichiers dans C:\WINDOWS\
*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\System32\taskkill.com FOUND
C:\WINDOWS\System32\netstat.com FOUND
C:\WINDOWS\system32\f3PSSavr.scr FOUND
"C:\Program Files\funwebproducts\" FOUND
"C:\Program Files\hbinst\" FOUND
"C:\Program Files\msn messenger\riched20.dll" FOUND
"C:\Program Files\MyWebSearch\" FOUND
*** Fin du rapport !
Post a comboscan log.
Hi,Jason86
Please try this again
Download The Avenger Copyright © Swandog46
You must extract avenger.exe to your desktop, before you run it.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Copy all the text contained in the code box below to your Clipboard.
NOTE: don't copy the word quote
The above script is for this user only, if you need help please start your own thread.
Start the Avenger.
Under "Script file to execute" choose "Input Script Manually".
Click on the Magnifying Glass icon which will open a new window titled "View/edit script".
Paste the entire text in into this window.
Click done, now click on the Green Light
Answer "Yes" twice when prompted.
Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.
After the restart, it will create a log file that should open.
This log file will be located at C:\avenger.txt
Paste the contents of C:\avenger.txt into your reply along with a fresh HijackThis! log.
Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.
----------------
Then do a reboot come back here with new HijackThis logfile and avenger.txt
Gogo
Please try this again
Download The Avenger Copyright © Swandog46
You must extract avenger.exe to your desktop, before you run it.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Copy all the text contained in the code box below to your Clipboard.
NOTE: don't copy the word quote
QUOTE
Files to delete:
C:\WINDOWS\System32\taskkill.com
C:\WINDOWS\System32\netstat.com
C:\WINDOWS\system32\f3PSSavr.scr
Folders to delete:
C:\Program Files\funwebproducts
C:\Program Files\hbinst
C:\Program Files\MyWebSearch
C:\Program Files\sysai
C:\WINDOWS\system32\nsgmgvmq
C:\WINDOWS\System32\taskkill.com
C:\WINDOWS\System32\netstat.com
C:\WINDOWS\system32\f3PSSavr.scr
Folders to delete:
C:\Program Files\funwebproducts
C:\Program Files\hbinst
C:\Program Files\MyWebSearch
C:\Program Files\sysai
C:\WINDOWS\system32\nsgmgvmq
The above script is for this user only, if you need help please start your own thread.
Start the Avenger.
Under "Script file to execute" choose "Input Script Manually".
Click on the Magnifying Glass icon which will open a new window titled "View/edit script".
Paste the entire text in into this window.
Click done, now click on the Green Light
Answer "Yes" twice when prompted.
Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.
After the restart, it will create a log file that should open.
This log file will be located at C:\avenger.txt
Paste the contents of C:\avenger.txt into your reply along with a fresh HijackThis! log.
Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.
----------------
Then do a reboot come back here with new HijackThis logfile and avenger.txt
Gogo
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\iwofsqrk
*******************
Script file located at: \??\C:\WINDOWS\system32\usviuehm.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\System32\taskkill.com deleted successfully.
File C:\WINDOWS\System32\netstat.com deleted successfully.
File C:\WINDOWS\system32\f3PSSavr.scr deleted successfully.
Folder C:\Program Files\funwebproducts deleted successfully.
Folder C:\Program Files\hbinst deleted successfully.
Folder C:\Program Files\MyWebSearch deleted successfully.
Folder C:\Program Files\sysai deleted successfully.
Folder C:\WINDOWS\system32\nsgmgvmq deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
AHHHH!!!! Finally able to run HiJackThis!!!!!!!!
Logfile of HijackThis v1.99.1
Scan saved at 2:56:26 AM, on 26/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jason\My Documents\Jason's Folder\Gonow.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: csrss.lnk = ?
O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\iwofsqrk
*******************
Script file located at: \??\C:\WINDOWS\system32\usviuehm.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\System32\taskkill.com deleted successfully.
File C:\WINDOWS\System32\netstat.com deleted successfully.
File C:\WINDOWS\system32\f3PSSavr.scr deleted successfully.
Folder C:\Program Files\funwebproducts deleted successfully.
Folder C:\Program Files\hbinst deleted successfully.
Folder C:\Program Files\MyWebSearch deleted successfully.
Folder C:\Program Files\sysai deleted successfully.
Folder C:\WINDOWS\system32\nsgmgvmq deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
AHHHH!!!! Finally able to run HiJackThis!!!!!!!!
Logfile of HijackThis v1.99.1
Scan saved at 2:56:26 AM, on 26/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jason\My Documents\Jason's Folder\Gonow.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: csrss.lnk = ?
O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
Hi,Jason86
Yes this is good now let's move on
Go to Start | Control Panel | Add/Remove Programs and remove the following (if they exist):
MyWebSearch
VBouncer
Note: Please that these items may need you to do a reboot to complete the Uninstall then please do so.
----------------
Please Download MsnVirRem.exe to your desktop from one of the following mirrors.
Mirror 1
Mirror 2
First close any other programs you have running as this will require a reboot
Double click MsnVirRem.exe to run it
Once open, click the button labelled "Search and Destroy"
<<Your computer will now be scanned for Infected Files>>
When scanning is finished you will be prompted to reboot only if infected, Click OK
Now click the "REBOOT" Button.
After the Reboot, you WILL receive file not found errors (usually 4) please acknowledge them and continue.
A Message should popup from MsnVirRem if not, double click the program again and it will finish
Please Post the contents of C:\msnvirrem.log along with a fresh HijackThis log
---------------
View hidden files and folders:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
---------------
Run HijackThis
Scan and when it finishes, put a check mark only next to these following items : (if present)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O4 - Startup: csrss.lnk = ?
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
Close all browsers and any open Windows, making sure that only HijackThis is open
Click Fix Checked
Close HijackThis
---------------
Using Windows Explorer (right-click your Start button and select Explore), please navigate to and delete the following FILES, FOLDERS (if they exist):
C:\Program Files\MyWebSearch\<---This folder
C:\Program Files\VBouncer\<---This folder
----------------
You're using an outdated version of Java (latest one is Java Runtime Environment (JRE) 6). Please update and remove the older versions. Do the following:
Go to Start | Control Panel | Add/Remove Programs
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
It should have this icon next to it:
Select it and click Remove.
Then download and install the newest version from here (scroll down to find it):
Java Runtime Environment (JRE) 6
----------------
Do a reboot come back here with new HijackThis logfile and feedback as to how PC is doing.
Gogo
Yes this is good now let's move on
Go to Start | Control Panel | Add/Remove Programs and remove the following (if they exist):
MyWebSearch
VBouncer
Note: Please that these items may need you to do a reboot to complete the Uninstall then please do so.
----------------
Please Download MsnVirRem.exe to your desktop from one of the following mirrors.
Mirror 1
Mirror 2
First close any other programs you have running as this will require a reboot
Double click MsnVirRem.exe to run it
Once open, click the button labelled "Search and Destroy"
<<Your computer will now be scanned for Infected Files>>
When scanning is finished you will be prompted to reboot only if infected, Click OK
Now click the "REBOOT" Button.
After the Reboot, you WILL receive file not found errors (usually 4) please acknowledge them and continue.
A Message should popup from MsnVirRem if not, double click the program again and it will finish
Please Post the contents of C:\msnvirrem.log along with a fresh HijackThis log
---------------
View hidden files and folders:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
---------------
Run HijackThis
Scan and when it finishes, put a check mark only next to these following items : (if present)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O4 - Startup: csrss.lnk = ?
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
Close all browsers and any open Windows, making sure that only HijackThis is open
Click Fix Checked
Close HijackThis
---------------
Using Windows Explorer (right-click your Start button and select Explore), please navigate to and delete the following FILES, FOLDERS (if they exist):
C:\Program Files\MyWebSearch\<---This folder
C:\Program Files\VBouncer\<---This folder
----------------
You're using an outdated version of Java (latest one is Java Runtime Environment (JRE) 6). Please update and remove the older versions. Do the following:
Go to Start | Control Panel | Add/Remove Programs
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
It should have this icon next to it:
Select it and click Remove.
Then download and install the newest version from here (scroll down to find it):
Java Runtime Environment (JRE) 6
----------------
Do a reboot come back here with new HijackThis logfile and feedback as to how PC is doing.
Gogo
Finally...sorry about the delay...
I couldn't access this site for the last week for some reason.
Back to business.
I couldn't access this site for the last week for some reason.
Back to business.
"Go to Start | Control Panel | Add/Remove Programs and remove the following (if they exist):
MyWebSearch
VBouncer"
I dont have those programs on the Add/Remove Programs List.
MsnVirRem.exe stalls (Not Responding) everytime I try to use it.
Should I continue with the next instructions?
MyWebSearch
VBouncer"
I dont have those programs on the Add/Remove Programs List.
MsnVirRem.exe stalls (Not Responding) everytime I try to use it.
Should I continue with the next instructions?
Hey,Jason86
No please show me a new HijackThis logfile just to make sure something new
did not get on the PC.
Gogo
No please show me a new HijackThis logfile just to make sure something new
did not get on the PC.
Gogo
Logfile of HijackThis v1.99.1
Scan saved at 4:06:48 PM, on 02/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\FirstClass\fcc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jason\My Documents\Jason's Folder\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: csrss.lnk = ?
O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
Scan saved at 4:06:48 PM, on 02/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\FirstClass\fcc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jason\My Documents\Jason's Folder\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: csrss.lnk = ?
O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
If you could post a comboscan log, it may be helpful.
Hey,Jason86
Sorry for the delay on this I just got my Cable back
let's try it this way.
----------------
Download SDFix and save it to your Desktop.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
( Don't run just Yet )
----------------
Please print out or copy these instructions to Notepad as the internet will not be available to you at certain points of the removal process (whilst in Safe Mode). If there's anything that you don't understand, ask your question(s) before moving on with the fix.
----------------
View hidden files and folders:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
-----------------
Run HijackThis
Scan and when it finishes, put a check mark only next to these following items : (if present)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
Close all browsers and any open Windows, making sure that only HijackThis is open
Click Fix Checked
Close HijackThis
-------------------
Restart your computer in Safe Mode.
-------------------
Next, please find and delete the following files/folders (if present):
C:\WINDOWS\system32\nsgmgvmq\<---This folder
C:\Program Files\MyWebSearch\<---This folder
C:\Program Files\VBouncer\<---This folder
-------------------
* Clean your Cache and Cookies in IE:
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
----------------
Then come back here with all logfiles.
Gogo
Sorry for the delay on this I just got my Cable back
let's try it this way.
----------------
Download SDFix and save it to your Desktop.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
( Don't run just Yet )
----------------
Please print out or copy these instructions to Notepad as the internet will not be available to you at certain points of the removal process (whilst in Safe Mode). If there's anything that you don't understand, ask your question(s) before moving on with the fix.
----------------
View hidden files and folders:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
-----------------
Run HijackThis
Scan and when it finishes, put a check mark only next to these following items : (if present)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 www.ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe
Close all browsers and any open Windows, making sure that only HijackThis is open
Click Fix Checked
Close HijackThis
-------------------
Restart your computer in Safe Mode.
- If the computer is running, shut down Windows, and then turn off the power.
- Wait 30 seconds, and then turn the computer on.
- Start tapping the F8 key. The Windows Advanced Options Menu will appear. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
- Ensure that the Safe Mode option is selected.
- Press Enter. The computer then begins to start in Safe Mode.
- Login on your usual account.
-------------------
Next, please find and delete the following files/folders (if present):
C:\WINDOWS\system32\nsgmgvmq\<---This folder
C:\Program Files\MyWebSearch\<---This folder
C:\Program Files\VBouncer\<---This folder
-------------------
* Clean your Cache and Cookies in IE:
- Close all instances of Outlook Express and Internet Explorer
- Go to Control Panel > Internet Options > General tab
- Click the "Delete Cookies" button
- Next to it, Click the "Delete Files" button
- When prompted, place a check in: "Delete all offline content", click OK
- Go to Tools > Options.
- Click Privacy in the menu on the left side of the Options window.
- Click the Clear button located to the right of each option (History, Cookies, Cache).
- Click OK to close the Options window
Alternatively, you can clear all information stored while browsing by clicking Clear All.
A confirmation dialog box will be shown before clearing the information.
- Go to start > run and type: cleanmgr and click ok.
- Let it scan your system for files to remove.
- Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
- Press OK to remove them.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
----------------
Then come back here with all logfiles.
Gogo
Thank you!
The function is in progress now.
I should be able to post when I return from work later.
The function is in progress now.
I should be able to post when I return from work later.
Hey,Jason86
No problme I will try and be here. right now my Cable is doing the KILL the Gogo thing
Gogo
No problme I will try and be here. right now my Cable is doing the KILL the Gogo thing
Gogo
Logfile of HijackThis v1.99.1
Scan saved at 3:37:11 PM, on 08/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Documents and Settings\Jason\My Documents\Jason's Folder\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: csrss.lnk = ?
O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
SDFix: Version 1.77
Run by Jason - 08/04/2007 - 15:21:53.90
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Below files will be copied to Backups folder then removed:
C:\WINDOWS\system32\drivers\etc\hosts.bho - Deleted
ADS Check:
Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.
Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.
Final Check:
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Warcraft III\\war3.exe"="C:\\Program Files\\Warcraft III\\war3.exe:*:Disabled:Warcraft III"
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Disabled:Warcraft III"
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE:*:Disabled:SAgent4"
"C:\\Program Files\\World of Warcraft\\WoW-1.2.4-to-1.3.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.2.4-to-1.3.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.3.1.4297-to-1.4.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.3.1.4297-to-1.4.0-enUS-downloader.exe:*:Disabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.4.2.4375-to-1.5.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.4.2.4375-to-1.5.0-enUS-downloader.exe:*:Disabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.7.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.7.0-enUS-downloader.exe:*:Disabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.8.4.4878-to-1.9.0.4937-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.8.4.4878-to-1.9.0.4937-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair[1].zip\\Repair.exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair[1].zip\\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\GXWBLDEG\\WoW-1.9.4.5086-to-0.10.0.5140-enUS-downloader[1].exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\GXWBLDEG\\WoW-1.9.4.5086-to-0.10.0.5140-enUS-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair.zip\\Repair.exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair.zip\\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\JI0RJT4L\\Flying_Mount_PC_EG-downloader[1].exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\JI0RJT4L\\Flying_Mount_PC_EG-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
Remaining Files:
---------------
Backups Folder: - C:\SDFix\backups\backups.zip
Checking For Files with Hidden Attributes:
C:\Documents and Settings\Jason\My Documents\MSN File Sharing\jason_y86@hotmail.com\My Shared Files\Thumbs.db
C:\Documents and Settings\Jason\NetHood\meeting on www.metropolitan.com\Desktop.ini
C:\Documents and Settings\Jason\NetHood\publications on www.uawdcx.com\Desktop.ini
C:\Documents and Settings\Jason\NetHood\tools on www.toolkit.cch.com\Desktop.ini
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0003.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0004.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0005.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0006.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0007.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0038.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0270.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0299.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0382.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0444.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0480.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0483.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0766.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0818.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1173.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1239.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1402.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1443.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1494.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1546.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1607.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1608.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1673.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1703.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1834.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1891.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1963.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2121.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2139.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2237.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2353.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2377.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2472.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2574.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2595.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2609.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2615.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2638.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2716.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3125.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3488.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3526.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3581.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3640.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3738.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3741.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3950.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3954.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL4035.tmp
C:\Documents and Settings\Jason\My Documents\~WRL0365.tmp
C:\Documents and Settings\Jason\My Documents\~WRL0898.tmp
C:\Documents and Settings\Jason\My Documents\~WRL2002.tmp
C:\Documents and Settings\Jason\My Documents\~WRL2423.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0011.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0025.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0045.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0122.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0167.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0423.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0504.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0516.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0532.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0715.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0997.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1060.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1132.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1583.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1597.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1608.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1736.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1842.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2178.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2379.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2416.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2810.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2882.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3056.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3213.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3341.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3358.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3727.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3781.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL4085.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\5a0d771158cfd69be5ddd26d8f58c73b\BIT1910.tmp
Finished
*NOTE*
C:\WINDOWS\system32\nsgmgvmq\
C:\Program Files\MyWebSearch\
C:\Program Files\VBouncer\
*NONE OF THESE FOLDERS COULD BE FOUND TO BE DELETED IN SAFE MODE*
Also,
I am also getting a Windows Security Alert that my virus protection status is unknown.
Scan saved at 3:37:11 PM, on 08/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Documents and Settings\Jason\My Documents\Jason's Folder\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: csrss.lnk = ?
O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
SDFix: Version 1.77
Run by Jason - 08/04/2007 - 15:21:53.90
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Below files will be copied to Backups folder then removed:
C:\WINDOWS\system32\drivers\etc\hosts.bho - Deleted
ADS Check:
Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.
Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.
Final Check:
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Warcraft III\\war3.exe"="C:\\Program Files\\Warcraft III\\war3.exe:*:Disabled:Warcraft III"
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Disabled:Warcraft III"
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE:*:Disabled:SAgent4"
"C:\\Program Files\\World of Warcraft\\WoW-1.2.4-to-1.3.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.2.4-to-1.3.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.3.1.4297-to-1.4.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.3.1.4297-to-1.4.0-enUS-downloader.exe:*:Disabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.4.2.4375-to-1.5.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.4.2.4375-to-1.5.0-enUS-downloader.exe:*:Disabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.7.0-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.6.1.4544-to-1.7.0-enUS-downloader.exe:*:Disabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.8.4.4878-to-1.9.0.4937-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.8.4.4878-to-1.9.0.4937-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair[1].zip\\Repair.exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair[1].zip\\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\GXWBLDEG\\WoW-1.9.4.5086-to-0.10.0.5140-enUS-downloader[1].exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\GXWBLDEG\\WoW-1.9.4.5086-to-0.10.0.5140-enUS-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.9.4.5086-to-1.10.0.5195-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair.zip\\Repair.exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temp\\Temporary Directory 1 for Repair.zip\\Repair.exe:*:Enabled:Blizzard Repair Utility"
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.10.2.5302-to-1.11.0.5428-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\JI0RJT4L\\Flying_Mount_PC_EG-downloader[1].exe"="C:\\Documents and Settings\\Jason\\Local Settings\\Temporary Internet Files\\Content.IE5\\JI0RJT4L\\Flying_Mount_PC_EG-downloader[1].exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-1.11.2.5464-to-1.12.0.5595-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
Remaining Files:
---------------
Backups Folder: - C:\SDFix\backups\backups.zip
Checking For Files with Hidden Attributes:
C:\Documents and Settings\Jason\My Documents\MSN File Sharing\jason_y86@hotmail.com\My Shared Files\Thumbs.db
C:\Documents and Settings\Jason\NetHood\meeting on www.metropolitan.com\Desktop.ini
C:\Documents and Settings\Jason\NetHood\publications on www.uawdcx.com\Desktop.ini
C:\Documents and Settings\Jason\NetHood\tools on www.toolkit.cch.com\Desktop.ini
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0003.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0004.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0005.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0006.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0007.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0038.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0270.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0299.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0382.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0444.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0480.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0483.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0766.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL0818.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1173.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1239.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1402.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1443.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1494.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1546.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1607.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1608.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1673.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1703.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1834.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1891.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL1963.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2121.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2139.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2237.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2353.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2377.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2472.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2574.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2595.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2609.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2615.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2638.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL2716.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3125.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3488.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3526.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3581.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3640.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3738.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3741.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3950.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL3954.tmp
C:\Documents and Settings\Jason\Application Data\Microsoft\Word\~WRL4035.tmp
C:\Documents and Settings\Jason\My Documents\~WRL0365.tmp
C:\Documents and Settings\Jason\My Documents\~WRL0898.tmp
C:\Documents and Settings\Jason\My Documents\~WRL2002.tmp
C:\Documents and Settings\Jason\My Documents\~WRL2423.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0011.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0025.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0045.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0122.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0167.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0423.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0504.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0516.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0532.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0715.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL0997.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1060.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1132.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1583.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1597.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1608.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1736.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL1842.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2178.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2379.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2416.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2810.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL2882.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3056.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3213.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3341.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3358.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3727.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL3781.tmp
C:\Documents and Settings\Jason\My Documents\My Pictures\Jen's Folder\~WRL4085.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\5a0d771158cfd69be5ddd26d8f58c73b\BIT1910.tmp
Finished
*NOTE*
C:\WINDOWS\system32\nsgmgvmq\
C:\Program Files\MyWebSearch\
C:\Program Files\VBouncer\
*NONE OF THESE FOLDERS COULD BE FOUND TO BE DELETED IN SAFE MODE*
Also,
I am also getting a Windows Security Alert that my virus protection status is unknown.
Hey,Jason86
The logfile looks a lot better now, please have a look at this link here about that warning
you keep getting.just look at page 2 then tell me if it was any help to you.
http://forums.techarena.in/showthread.php?t=635241
Also could you update your Java
You're using an outdated version of Java (latest one is Java Runtime Environment (JRE) 6u1 ). Please update and remove the older versions. Do the following:
Go to Start | Control Panel | Add/Remove Programs
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
It should have this icon next to it:
Select it and click Remove.
Then download and install the newest version from here (scroll down to find it):
Java Runtime Environment (JRE) 6u1.
Do a reboot
Come back here tell me how PC is doing now.
Gogo
The logfile looks a lot better now, please have a look at this link here about that warning
you keep getting.just look at page 2 then tell me if it was any help to you.
http://forums.techarena.in/showthread.php?t=635241
Also could you update your Java
You're using an outdated version of Java (latest one is Java Runtime Environment (JRE) 6u1 ). Please update and remove the older versions. Do the following:
Go to Start | Control Panel | Add/Remove Programs
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
It should have this icon next to it:
Select it and click Remove.
Then download and install the newest version from here (scroll down to find it):
Java Runtime Environment (JRE) 6u1.
Do a reboot
Come back here tell me how PC is doing now.
Gogo
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.