Sign in to follow this  
Jason86

Followed Instructions Above But...

Recommended Posts

I followed the instructions above and started the scan through hijackthis.exe.

The program closes seconds into its progress....everytime.

 

Any help as to what to do next would be fantastic.

Thanks!

Share this post


Link to post
Share on other sites

Hello,Jason86 & Welcome

 

First make sure you are extracting HijackThis.exe and not trying to run it from

it's zip or rar file/folder.

 

Unzip HijackThis:

 

Right-click on the HijackThis zip folder and choose "Extract All".

An extraction wizard window will now open. Click "Next".

In the "Files will be extracted to this directory:" field, type C:\HJT. Then click "Next".

Click "Finish" to show your unzipped/extracted HijackThis folder. Run HijackThis.exe from here, or add a shortcut to your desktop.

 

--------------

 

NOTE: Before you run a scan do this for me goto where you installed HijackThis.exe

and rename it to say Cando.exe, now run your scan show me logfile.

 

Gogo :)

Share this post


Link to post
Share on other sites

Hrmmm...

The filename is changed and the instructions were followed as you outlined....

 

Still the same result.

It closes within seconds of being open.

 

Regards,

 

Jason

Share this post


Link to post
Share on other sites

Hi,Jason

 

Feedback are you first extracting HijackThis.exe from it's zip/rar file or folder.???

as I had said above please.

 

Gogo ;)

Share this post


Link to post
Share on other sites

Hi,Jason

 

Please goto this site here and download the HijackThis Executable

http://www.trendsecure.com/portal/en-US/th...hijackthis.php#

 

NOTE: This is in beta version

 

Also

 

System requirements:

 

Operating System:

 

 

* Microsoftâ„¢ Windowsâ„¢ XP

 

* Microsoftâ„¢ Windowsâ„¢ 2000

 

 

*May require Visual Basic Runtime Libraries available from Microsoft here

 

 

Software:

 

* Microsoftâ„¢ Internet Explorer 7.0

 

* Microsoftâ„¢ Internet Explorer 6.0

 

* Mozillaâ„¢ Firefoxâ„¢ 1.5 or higher

 

Gogo ;)

Share this post


Link to post
Share on other sites

Thanks so much for all of your advice so far...

 

After downloading the executable file from the link that you posted, the function, once it starts scanning, immedietly shuts down as it did with the previous attempts.

 

I relocated that executable file several times and renamed it several times...but all the same result

 

Regards,

 

Jason

Share this post


Link to post
Share on other sites

Hey,Jason86

 

Hmm odd well let's try running these tools here

 

Please download SUPERAntiSpyware Home Edition (free version)

Install it and double-click the icon on your desktop to run it.

It will ask if you want to update the program definitions, click Yes.

Under Configuration and Preferences, click the Preferences button.

Click the Scanning Control tab.

Under Scanner Options make sure the following are checked:

Close browsers before scanning

Scan for tracking cookies

Terminate memory threats before quarantining.

Please leave the others unchecked.

Click the Close button to leave the control center screen.

On the main screen, under Scan for Harmful Software click Scan your computer.

On the left check C:\Fixed Drive.

On the right, under Complete Scan, choose Perform Complete Scan.

Click Next to start the scan. Please be patient while it scans your computer.

After the scan is complete a summary box will appear. Click OK.

Make sure everything in the white box has a check next to it, then click Next.

It will quarantine what it found and if it asks if you want to reboot, click Yes.

To retrieve the removal information for me please do the following:

After reboot, double-click the SUPERAntispyware icon on your desktop.

Click Preferences. Click the Statistics/Logs tab.

Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

It will open in your default text editor (such as Notepad/Wordpad).

Please highlight everything in the notepad, then right-click and choose copy.

Click close and close again to exit the program.

Please paste that information here for me with a new HijackThis log.

 

-------------

 

Please download CCleaner (freeware) and save it to your desktop:

 

*Run the CCleaner installer.

*During installation process, please UNCHECK "Add CCleaner Yahoo! Toolbar".

*Once installed, run CCleaner and click the Windows tab.

*Select the following:

*Check everything under the Internet Explorer section.

*Check everything under the Windows Explorer section.

*Check everything under the System section.

*Check ONLY Old Prefetch data under the Advanced section.

*Then, click the Applications tab:

*UNCHECK everything there.

*Next, click the Options button, then click the Advanced button:

*UNCHECK : "Only delete files in Windows Temp folders older than 48 hours".

*Next, click the Cleaner button, then click the Run Cleaner button (bottom right), then Exit.

 

CAUTION : Please do NOT use the Issues button. This is a built-in registry cleaner. If you don’t know how to use it, you may cause irreparable damage to your system.

 

--------------

 

Then come back here with all logfiles.

 

Gogo ;)

Share this post


Link to post
Share on other sites

SUPERAntiSpyware Scan Log

Generated 03/23/2007 at 05:35 AM

 

Application Version : 3.6.1000

 

Core Rules Database Version : 3205

Trace Rules Database Version: 1215

 

Scan type : Complete Scan

Total Scan Time : 03:16:39

 

Memory items scanned : 335

Memory threats detected : 1

Registry items scanned : 5002

Registry threats detected : 41

File items scanned : 54511

File threats detected : 57

 

Adware.MyWebSearch

C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE

C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE

[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE

[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE

HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\Programmable

C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL

HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable

HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\Programmable

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\TypeLib

C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL

HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\Programmable

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\TypeLib

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

HKU\S-1-5-21-4025279379-1021817841-4004396944-1007\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}

C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE

 

Kontiki Download Manager Browser Helper Object

HKLM\Software\Classes\CLSID\{029CA12C-89C1-46a7-A3C7-82F2F98635CB}

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\InprocServer32

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\InprocServer32#ThreadingModel

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\ProgID

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\Programmable

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\TypeLib

HKCR\CLSID\{029CA12C-89C1-46A7-A3C7-82F2F98635CB}\VersionIndependentProgID

C:\PROGRAM FILES\KONTIKI\BIN\BH304181.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029CA12C-89C1-46a7-A3C7-82F2F98635CB}

 

Adware.Tracking Cookie

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected]acebook[1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][3].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][5].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][4].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][4].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

C:\Documents and Settings\Jason\Cookies\[email protected][1].txt

 

Adware.180solutions/Search Assistant

C:\DOCUMENTS AND SETTINGS\JASON\LOCAL SETTINGS\TEMP\DEL2D5.TMP

 

Adware.Lop

C:\PROGRAM FILES\C2MEDIA\SETUP.EXE

 

Adware.HotBar (Low Risk)

C:\PROGRAM FILES\HBINST\HBINST.EXE

 

Worm.Alcra Variant

C:\WINDOWS\SYSTEM32\NETSTAT.COM

C:\WINDOWS\SYSTEM32\TASKKILL.COM

Share this post


Link to post
Share on other sites

Hi,Jason86

 

Now was this any help to you did you try running HijackThis again

give me feedback here.

 

Gogo ;)

Share this post


Link to post
Share on other sites

CCleaner Log

 

CLEANING COMPLETE - (101.681 secs)

------------------------------------------------------------------------------------------

467.1MB removed.

------------------------------------------------------------------------------------------

 

Details of files deleted

------------------------------------------------------------------------------------------

IE Temporary Internet Files (4310 files) 194.2MB

Cookie:[email protected]/(&H100001) 85 bytes

Cookie:[email protected]/(&H100001) 128 bytes

Cookie:[email protected]/(&H100001) 697 bytes

Cookie:[email protected]/(&H100001) 97 bytes

Cookie:[email protected]/(&H100001) 375 bytes

Cookie:[email protected]/a(&H100001) 101 bytes

Cookie:[email protected]/(&H100001) 99 bytes

Cookie:[email protected]/cheats/(&H100001) 88 bytes

Cookie:[email protected]/(&H100001) 182 bytes

Cookie:[email protected]/(&H100001) 83 bytes

Cookie:[email protected]/(&H100001) 112 bytes

Cookie:[email protected]/(&H100001) 600 bytes

Cookie:[email protected]/games/free/(&H100001) 84 bytes

Cookie:[email protected]/(&H100001) 107 bytes

Cookie:[email protected]/(&H100001) 89 bytes

Cookie:[email protected]/(&H100001) 244 bytes

Cookie:[email protected]/(&H100001) 198 bytes

Cookie:[email protected]/(&H100001) 264 bytes

Cookie:[email protected]/(&H100001) 137 bytes

Cookie:[email protected]/(&H100001) 184 bytes

Cookie:[email protected]/(&H100001) 530 bytes

Cookie:[email protected]/(&H100001) 337 bytes

Cookie:[email protected]/(&H100001) 113 bytes

Cookie:[email protected]/(&H100001) 353 bytes

Cookie:[email protected]/(&H100001) 208 bytes

Cookie:[email protected]/(&H100001) 70 bytes

Cookie:[email protected]/(&H100001) 94 bytes

Cookie:[email protected]/(&H100001) 81 bytes

Cookie:[email protected]/crc(&H100001) 126 bytes

Cookie:[email protected]/(&H100001) 629 bytes

Cookie:[email protected]/(&H100001) 764 bytes

Cookie:[email protected]/(&H100001) 94 bytes

Cookie:[email protected]/(&H100001) 90 bytes

Cookie:[email protected]/(&H100001) 170 bytes

Cookie:[email protected]/(&H100001) 78 bytes

Cookie:[email protected]/(&H100001) 147 bytes

Cookie:[email protected]/(&H100001) 155 bytes

Cookie:[email protected]/(&H100001) 419 bytes

Cookie:[email protected]/(&H100001) 74 bytes

Cookie:[email protected]/(&H100001) 258 bytes

Cookie:[email protected]/(&H100001) 454 bytes

Cookie:[email protected]/(&H100001) 237 bytes

Cookie:[email protected]/tgp/(&H100001) 168 bytes

Cookie:[email protected]/(&H100001) 377 bytes

Cookie:[email protected]/(&H100001) 80 bytes

Cookie:[email protected]/(&H100001) 78 bytes

Cookie:[email protected]/(&H100001) 103 bytes

Cookie:[email protected]/(&H100001) 204 bytes

Cookie:[email protected]/(&H100001) 130 bytes

Cookie:[email protected]/(&H100001) 159 bytes

Cookie:[email protected]/(&H100001) 238 bytes

Cookie:[email protected]/(&H100001) 177 bytes

Cookie:[email protected]/(&H100001) 99 bytes

Cookie:[email protected]/(&H100001) 168 bytes

Cookie:[email protected]/(&H100001) 156 bytes

Cookie:[email protected]/(&H100001) 200 bytes

Cookie:[email protected]/(&H100001) 83 bytes

Cookie:[email protected]/app(&H100001) 292 bytes

Cookie:[email protected]/(&H100001) 536 bytes

Cookie:[email protected]/(&H100001) 75 bytes

Cookie:[email protected]/(&H100001) 77 bytes

Cookie:[email protected]/(&H100001) 175 bytes

Cookie:[email protected]/(&H100001) 120 bytes

Cookie:[email protected]/(&H100001) 95 bytes

Cookie:[email protected]/(&H100001) 122 bytes

Cookie:[email protected]/(&H100001) 367 bytes

Cookie:[email protected]/(&H100001) 115 bytes

Cookie:[email protected]/(&H100001) 105 bytes

Cookie:[email protected]/(&H100001) 291 bytes

Cookie:[email protected]/n/20213(&H100001) 149 bytes

Cookie:[email protected]/(&H100001) 78 bytes

Cookie:[email protected]/(&H100001) 112 bytes

Cookie:[email protected]/(&H100001) 156 bytes

Cookie:[email protected]/(&H100001) 518 bytes

Cookie:[email protected]/nymetro/arts/tv/reviews/9579/(&H100001) 108 bytes

Cookie:[email protected]/(&H100001) 394 bytes

Cookie:[email protected]/(&H100001) 233 bytes

Cookie:[email protected]/(&H100001) 128 bytes

Cookie:[email protected]/(&H100001) 685 bytes

Cookie:[email protected]/(&H100001) 335 bytes

Cookie:[email protected]/(&H100001) 100 bytes

Cookie:[email protected]/en-ca/(&H100001) 71 bytes

Cookie:[email protected]/(&H100001) 104 bytes

Cookie:[email protected]/Waiterblog_Forum(&H100001) 250 bytes

Cookie:[email protected]/(&H100001) 224 bytes

Cookie:[email protected]/(&H100001) 334 bytes

Cookie:[email protected]/(&H100001) 160 bytes

Cookie:[email protected]/(&H100001) 121 bytes

Cookie:[email protected]/(&H100001) 87 bytes

Cookie:[email protected]/(&H100001) 221 bytes

Cookie:[email protected]/(&H100001) 753 bytes

Cookie:[email protected]/(&H100001) 102 bytes

Cookie:[email protected]/(&H100001) 106 bytes

Cookie:[email protected]/(&H100001) 271 bytes

Cookie:[email protected]/(&H100001) 269 bytes

Cookie:[email protected]/(&H100001) 740 bytes

Cookie:[email protected]/(&H100001) 294 bytes

Cookie:[email protected]/(&H100001) 99 bytes

Cookie:[email protected]/(&H100001) 88 bytes

Cookie:[email protected]/(&H100001) 98 bytes

Cookie:[email protected]/(&H100001) 362 bytes

Cookie:[email protected]/(&H100001) 208 bytes

Cookie:[email protected]/(&H100001) 81 bytes

Cookie:[email protected]/(&H100001) 346 bytes

Cookie:[email protected]/guest/(&H100001) 82 bytes

Cookie:[email protected]/(&H100001) 1021 bytes

Cookie:[email protected]/(&H100001) 273 bytes

Cookie:[email protected]/(&H100001) 190 bytes

Cookie:[email protected]/(&H100001) 303 bytes

Cookie:[email protected]/(&H100001) 434 bytes

Cookie:[email protected]/(&H100001) 101 bytes

Cookie:[email protected]/(&H100001) 364 bytes

Cookie:[email protected]/(&H100001) 90 bytes

Cookie:[email protected]/(&H100001) 860 bytes

Cookie:[email protected]/(&H100001) 89 bytes

Cookie:[email protected]/(&H100001) 294 bytes

Cookie:[email protected]/(&H100001) 187 bytes

Cookie:[email protected]/(&H100001) 186 bytes

Cookie:[email protected]/(&H100001) 368 bytes

Cookie:[email protected]/(&H100001) 103 bytes

Cookie:[email protected]/(&H100001) 202 bytes

Cookie:[email protected]/(&H100001) 89 bytes

Cookie:[email protected]/(&H100001) 540 bytes

Cookie:[email protected]/(&H100001) 458 bytes

Cookie:[email protected]/(&H100001) 349 bytes

Cookie:[email protected]/(&H100001) 377 bytes

Cookie:[email protected]/m2/cnet(&H100001) 203 bytes

Cookie:[email protected]/cgi-bin/(&H100001) 181 bytes

Cookie:[email protected]/(&H100001) 343 bytes

Cookie:[email protected]/(&H100001) 417 bytes

Cookie:[email protected]/(&H100001) 362 bytes

Cookie:[email protected]/support/youtube/(&H100001) 414 bytes

Cookie:[email protected]/(&H100001) 180 bytes

Cookie:[email protected]/(&H100001) 155 bytes

Cookie:[email protected]/(&H100001) 522 bytes

Cookie:[email protected]/(&H100001) 672 bytes

Cookie:[email protected]/(&H100001) 134 bytes

Cookie:[email protected]/(&H100001) 389 bytes

Cookie:[email protected]/(&H100001) 87 bytes

Cookie:[email protected]/(&H100001) 366 bytes

Cookie:[email protected]/(&H100001) 185 bytes

Cookie:[email protected]/(&H100001) 100 bytes

Cookie:[email protected]/(&H100001) 87 bytes

Cookie:[email protected]/(&H100001) 121 bytes

Cookie:[email protected]/(&H100001) 162 bytes

Cookie:[email protected]/(&H100001) 337 bytes

Cookie:[email protected]/(&H100001) 119 bytes

Cookie:[email protected]/(&H100001) 690 bytes

Cookie:[email protected]/(&H100001) 607 bytes

Cookie:[email protected]/(&H100001) 392 bytes

Cookie:[email protected]/(&H100001) 314 bytes

Cookie:[email protected]/(&H100001) 380 bytes

Cookie:[email protected]/(&H100001) 993 bytes

Cookie:[email protected]/(&H100001) 273 bytes

Cookie:[email protected]/(&H100001) 351 bytes

Cookie:[email protected]/(&H100001) 380 bytes

Cookie:[email protected]/(&H100001) 394 bytes

Cookie:[email protected]/(&H100001) 398 bytes

Cookie:[email protected]/(&H100001) 505 bytes

Cookie:[email protected]/(&H100001) 464 bytes

Cookie:[email protected]/(&H100001) 170 bytes

Cookie:[email protected]/(&H100001) 146 bytes

Cookie:[email protected]/(&H100001) 108 bytes

Cookie:[email protected]/(&H100001) 945 bytes

Cookie:[email protected]/(&H100001) 415 bytes

Cookie:[email protected]/(&H100001) 104 bytes

Cookie:[email protected]/(&H100001) 84 bytes

Cookie:[email protected]/(&H100001) 102 bytes

Cookie:[email protected]/(&H100001) 595 bytes

Cookie:[email protected]/bb(&H100001) 174 bytes

Cookie:[email protected]/(&H100001) 404 bytes

Cookie:[email protected]/(&H100001) 295 bytes

Cookie:[email protected]/cgi-bin/(&H100001) 464 bytes

Cookie:[email protected]/(&H100001) 80 bytes

Cookie:[email protected]/(&H100001) 392 bytes

Cookie:[email protected]/(&H100001) 164 bytes

Cookie:[email protected]/(&H100001) 107 bytes

Cookie:[email protected]/(&H100001) 178 bytes

Cookie:[email protected]/(&H100001) 175 bytes

Cookie:[email protected]/(&H100001) 359 bytes

Cookie:[email protected]/(&H100001) 89 bytes

Cookie:[email protected]/(&H100001) 251 bytes

Cookie:[email protected]/(&H100001) 122 bytes

Cookie:[email protected]/(&H100001) 118 bytes

Cookie:[email protected]/(&H100001) 98 bytes

Cookie:[email protected]/(&H100001) 176 bytes

Cookie:[email protected]/(&H100001) 71 bytes

Cookie:[email protected]/(&H100001) 75 bytes

Cookie:[email protected]/(&H100001) 116 bytes

Cookie:[email protected]/(&H100001) 541 bytes

Cookie:[email protected]/(&H100001) 102 bytes

Cookie:[email protected]/(&H100001) 83 bytes

Cookie:[email protected]/(&H100001) 114 bytes

Cookie:[email protected]/(&H100001) 92 bytes

Cookie:[email protected]/(&H100001) 414 bytes

Cookie:[email protected]/(&H100001) 137 bytes

Cookie:[email protected]/(&H100001) 338 bytes

Cookie:[email protected]/(&H100001) 504 bytes

C:\Documents and Settings\Jason\Cookies\[email protected][2].txt 0 bytes

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\desktop.ini 113 bytes

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003060120030602\index.dat 48.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003083120030901\index.dat 0.16MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003092620030927\index.dat 96.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012003110720031108\index.dat 48.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004021520040216\index.dat 80.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004022220040223\index.dat 0.13MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004022920040301\index.dat 96.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004030720040308\index.dat 0.22MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004031320040314\index.dat 0.11MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004032120040322\index.dat 0.11MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004071120040712\index.dat 0.11MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004072820040729\index.dat 96.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004072920040730\index.dat 48.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012004100120041002\index.dat 0.17MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005010120050102\index.dat 0.13MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005012420050125\index.dat 64.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005012920050130\index.dat 0.13MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005022020050221\index.dat 0.16MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005040820050409\index.dat 80.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005041020050411\index.dat 0.11MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005050420050505\index.dat 0.14MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005050620050507\index.dat 0.11MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005051520050516\index.dat 96.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005103020051031\index.dat 64.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005110620051107\index.dat 0.22MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005112020051121\index.dat 64.00KB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005112620051127\index.dat 0.14MB

C:\Documents and Settings\Jason\Local Settings\History\History.IE5\MSHist012005121820051219\index.dat 96.00KB

Marked for deletion: C:\Documents and Settings\Jason\Local Settings\Temporary Internet Files\Content.IE5\index.dat

Marked for deletion: C:\Documents and Settings\Jason\Cookies\index.dat

Marked for deletion: C:\Documents and Settings\Jason\Local Settings\History\History.IE5\index.dat

C:\WINDOWS\TEMP\DrvLsnr1119660357.log 1.95KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0108.cat 6.67KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0108.INF 1.11KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010a.cat 6.67KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4cb010A.inf 1.12KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010d.cat 6.70KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB010D.INF 1.12KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb010e.cat 6.66KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB010E.INF 1.21KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0110.cat 6.66KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0110.INF 1.21KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0112.cat 6.67KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0112.INF 1.12KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0114.cat 6.66KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0114.INF 1.12KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0116.cat 6.66KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0116.INF 1.21KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb0118.cat 6.66KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB0118.INF 1.21KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb011a.cat 6.66KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB011A.INF 1.21KB

C:\WINDOWS\TEMP\FUJIUSBDRV\u4cb011c.cat 6.66KB

C:\WINDOWS\TEMP\FUJIUSBDRV\U4CB011C.INF 1.21KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0109.cat 7.08KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0109.inf 2.35KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4CB0109.SYS 79.88KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb010b.cat 7.08KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010B.inf 2.36KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010B.sys 80.00KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb010f.cat 7.06KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010F.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb010F.sys 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0111.cat 7.06KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0111.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0111.sys 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0113.cat 7.08KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0113.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0113.sys 80.00KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0115.cat 7.06KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0115.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0115.sys 80.00KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0117.cat 7.06KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0117.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0117.sys 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0119.cat 7.06KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0119.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0119.sys 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb011b.cat 7.06KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011B.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011B.sys 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb011d.cat 7.06KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011D.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb011D.sys 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0121.cat 7.02KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0121.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0121.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0123.cat 7.02KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0123.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0123.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0125.cat 7.02KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0125.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0125.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0127.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0127.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0127.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0129.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0129.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0129.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012b.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012B.inf 2.37KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012B.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012d.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012D.inf 2.40KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012D.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb012f.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012F.inf 2.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb012F.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb0131.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0131.inf 2.40KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb0131.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013b.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013B.inf 2.40KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013B.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013d.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013D.inf 2.40KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013D.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\v4cb013f.cat 7.44KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013F.inf 2.40KB

C:\WINDOWS\TEMP\FUJIUSBDRV\V4cb013F.SYS 79.79KB

C:\WINDOWS\TEMP\FUJIUSBDRV\VC4CB104.INF 3.04KB

C:\WINDOWS\TEMP\FUJIUSBDRV\VC4CB104.SYS 80.00KB

C:\WINDOWS\TEMP\MSIc7c50.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\1.11.2.5464.enUS 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\1621B7.tmp 0.50MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\2nd annual Christmas letter.doc 4.47MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax101.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax112.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax14.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax146.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1649.tmp 66.65KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164D.tmp 68.03KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164E.tmp 66.65KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX164F.tmp 0.16MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1650.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax17.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX18.tmp 31.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax19D.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX1A.tmp 23.05KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1AD7.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1AFF.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax1E2.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax24E.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax2F7.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax3.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax31.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34C.tmp 31.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34D.tmp 33.91KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34E.tmp 31.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX34F.tmp 33.91KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX350.tmp 31.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX351.tmp 33.91KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX352.tmp 31.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX353.tmp 33.91KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax3DC.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax430.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax57C.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX59.tmp 31.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAX5A.tmp 33.91KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax622.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7C.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7E9.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax7EA.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax85.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aax85F.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxB2E.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxCA.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxCB.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAXE3.tmp 33.91KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxE3E.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\aaxE6F.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\AAXEC.tmp 23.05KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\ABDComponents.dll 0.25MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Barbecue Glazed Pork Chops.doc 37.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\CmdLineExt02.dll 36.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\control.xml 12.63KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\cpuSI.dll 48.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-anim.png 17.39KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-burn.png 17.89KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-empty.png 15.23KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-full.png 14.17KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\burn-layer.png 13.71KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\buttons.png 41.25KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\compact-resize.png 3.05KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\compact.png 3.33KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\divx.png 1.20KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\fullscreen.png 7.62KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\logo.png 2.31KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\main-resize.png 1.64KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\main.png 13.64KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\screenshot.png 26.87KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\skin.divl 39.27KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Default\tree-layer.png 13.09KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Doc1.doc 20.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\dsw345.tmp 2.66MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla131.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla132.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1377.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla158.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla159.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E0.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E1.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E2.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla15E3.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla167.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla168.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla19.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1A.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1A17.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1ACE.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1ACF.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1AD5.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1AD6.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla1E1.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla217.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla25.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla26.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2D.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2DB.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla2F.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3D8.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3DA.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla3DE.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla4.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla5E1.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla69.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6A.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6C.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla6D.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla7.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla87.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla88.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla89.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla8A.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla8C.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\fla90.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE38.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE39.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3A.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3B.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3C.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\flaE3D.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\flaF0.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\h2r33.tmp 4.22KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\h2r4.tmp 42.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\History\History.IE5\desktop.ini 113 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT14.xml 1.95KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT15.xml 426 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT16.xml 0.67MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT25.xml 1.95KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT26.xml 426 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\IMT27.xml 0.67MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Install_Messenger.exe 18.0MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\InstHelp.dll 56.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\java_install_reg.log 41.17KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\jusched.log 88.74KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_autodelete.png 366 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1.png 307 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1_def.png 307 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_suspend__-1_ro.png 307 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1.png 271 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1_def.png 271 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_image_pldwn_speed_turbo__-1_ro.png 271 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_preview_bkgd.png 322 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175.png 484 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175_def.png 519 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_check_Turn-On-Disk-Management_175_ro.png 479 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175.png 323 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175_def.png 377 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\k.images\GameSpot_1_0_0_7_std_btn_icon_x_Cancel_175_ro.png 324 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\KDA6B.tmp 709 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\kmdb.html 843 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1266.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1267.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1268.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1269.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126a.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126b.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI126c.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dcf.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd0.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd1.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd2.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI14dd3.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19183.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19184.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19185.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19186.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19187.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19188.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19189.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918a.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918b.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918c.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918d.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918e.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1918f.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI19190.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1a083.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI1a084.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI20540.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI20541.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1db.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1dc.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1dd.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1de.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1df.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e0.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e1.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e2.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI2e1e3.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c13.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c14.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c15.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI40c16.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca5.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca6.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca7.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca8.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bca9.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcaa.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcab.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcac.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcad.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcae.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcaf.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcb0.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI4bcb1.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59616.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59617.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI59618.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI64d7a.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI64d7b.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66402.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66403.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66404.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI66405.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15a.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15b.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15c.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI6b15d.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI79c93.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI79c94.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8e710.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8fed1.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI8fed2.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9782f.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI97830.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9a28c.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9b1e3.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSI9b1e4.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e7e.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e7f.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e80.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIa5e81.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIbc77a.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIbc77b.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6345.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6346.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6347.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6348.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc6349.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d3.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d4.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d5.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d6.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d7.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d8.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78d9.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78da.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78db.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78dc.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIc78dd.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfc.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfd.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cfe.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5cff.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5d00.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIe5d01.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec1.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec2.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec3.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec4.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec5.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec6.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIf8ec7.LOG 348 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79d.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79e.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb79f.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSIfb7a0.LOG 350 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\msnsearch.exe 0.22MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso109.wmf 2.24MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso19FC.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso19FD.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso203.wmf 236 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso290.icm 3.07KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso2A.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso2B.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso30.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso32C.doc 0.22MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso37A.wmf 9.68KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso399.wmf 15.04KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3A9.wmf 19.36KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3B9.wmf 30.48KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso3C8.wmf 2.24MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso6D.wmf 0.29MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso9A.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\mso9E.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\msoCA.doc 30.78KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\msoE4.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\MSSSerif120.fon 87.58KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\msvbvm60.DLL 1.32MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PCloser.dll 28.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pconfig.dcf 123 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ph.msm 0.29MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PrimoSDK.dll 0.15MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\px.dll 0.36MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\px.msm 0.52MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxCpyA64.exe 55.50KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxCpyI64.exe 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxdrv.dll 0.40MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxdrv.msm 53.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelp20.inf 1.61KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelp20.sys 20.16KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxHelp64.sys 53.81KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.inf 1.35KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.sys 31.98KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhelper.vxd 12.06KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxHlpa64.sys 26.09KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxhpinst.exe 60.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxInsA64.exe 55.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\PxInsI64.exe 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxmas.dll 0.16MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxsetup.exe 60.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\pxwave.dll 0.32MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_de.qm 26.17KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_fr.qm 25.57KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\qt_ja.qm 2.81KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-de.txt 3.77KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-en.txt 3.15KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-fr.txt 3.52KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe-ja.txt 4.83KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_de.txt 4.02KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_en.txt 3.58KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_fr.txt 4.24KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\ReadMe_ja.txt 4.81KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\side-banner-divxforwindows.bmp 0.16MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\splash-screen-nostretch.ini 236 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\System.dll 9.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\toolbar-complete.bmp 24.66KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\toolbar-screenshot.bmp 57.67KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\version-check.ini 410 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\nsu5F.tmp\vxblock.dll 28.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\OLEAUT32.DLL 0.57MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\qmgr.cab 77.52KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\qmgr.inf 2.02KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Quest3D0\channels.lst 40.27KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17C.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17D.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17E.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set17F.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set180.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set181.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set182.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set222.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set223.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\set226.tmp 45.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set227.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\set41.tmp 53.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\set42.tmp 53.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set43.tmp 0.10MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Set50.tmp 0.16MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\set8C.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntf16.dll 11.78KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntf32.dll 19.46KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntfIcn.ani 4.48KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\SIntfNT.dll 23.94KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\SSUPDATE.EXE 0.14MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\SysInfoGatherer.exe 0.29MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TempFolder.aaa\Macromedia.lok 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for EXFXJZ9J.ZIP\com\ms\wfc\data\adodb\Parameter.class 1.34KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for fable_521_wm.zip\fable_521.mpg 105.6MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for Peppers[1].zip\Peppers.pot 74.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 1 for WinNotePad2003.zip\WinNotePad2003.exe 3.99MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Directory 2 for Peppers[1].zip\Peppers.pot 74.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5XURS1MF\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\23ET8PWV\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\2H4DE5ST\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\8PMVCPYB\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\AQ6PH9KM\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\DO5P395R\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\EHK9AFAV\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\GD2RCD2Z\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\NVL9L992\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\PF7JD5CY\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\Q5D2ZEPW\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\QVMZ0941\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\S5M74HMR\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SB53EAN9\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\STUBIF0D\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\YWJ8826C\desktop.ini 67 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR157.tmp 37.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR158.tmp 66.40KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR15C.tmp 34.74KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR161.tmp 9.99KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR166.tmp 61.28KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR169.tmp 22.88KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR16E.tmp 20.63KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR171.tmp 22.72KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR177.tmp 44.94KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR179.tmp 15.80KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR17D.tmp 23.05KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR181.tmp 20.08KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR185.tmp 45.57KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR189.tmp 39.99KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR18C.tmp 57.83KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR19B.tmp 0.12MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR19F.tmp 82.06KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR21.tmp 79.06KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR22.tmp 44.94KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR23.tmp 34.74KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR28.tmp 61.28KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR2E.tmp 39.99KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR32.tmp 61.28KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR33.tmp 22.72KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR34.tmp 39.99KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR37.tmp 22.72KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR38.tmp 20.08KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR39.tmp 20.08KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3C.tmp 57.83KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3D.tmp 45.57KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3E.tmp 37.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR3F.tmp 66.40KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR40.tmp 57.83KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR52.tmp 44.94KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR53.tmp 15.80KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR58.tmp 23.05KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR5B.tmp 20.63KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR5F.tmp 22.88KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR63.tmp 9.99KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFR64.tmp 34.74KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE3.tmp 34.74KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE4.tmp 61.28KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE6.tmp 39.99KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRE7.tmp 22.72KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFREA.tmp 20.08KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFREE.tmp 57.83KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRF2.tmp 45.57KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\TFRF3.tmp 37.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\theLogFile.txt 17.69KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp30B20.FOT 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp8DC20.FOT 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\tmp95720.FOT 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\tmpE3920.FOT 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A0.tmp 7.16KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A1.tmp 5.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A2.tmp 7.16KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4A3.tmp 5.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4B3.tmp 5.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX4B4.tmp 7.16KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\VGX83A.tmp 41.04KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\war3_Install.exe 0.28MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\wecerr.txt 271 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv19B.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv19C.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv21.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\wmv22.tmp 0 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\Word8.0\MSForms.exd 0.16MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\Yamasaki Rec's 051706 (2) (2).xls 26.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 12.16KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 9.96KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 5.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 6.84KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 6.05KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 12.56KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 27.14KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 4.88KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 18.42KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 10.63KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 8.15KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\[email protected] 1.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd1.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd10.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd11.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd12.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd2.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd3.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd4.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd5.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd6.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd7.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd8.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\bbrd9.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\halloween.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\knights.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\lewis.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\painted.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd1.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd10.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd11.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd12.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd2.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd3.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd4.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd5.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd6.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd7.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd8.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\bbrd9.bmp 1.37MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\halloween.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\knights.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\lewis.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\painted.bmp 94.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\Acrobat.bmp 31.52KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\AdobeIns.ini 6.11KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\BBrd1.BMP 0.12MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\BrwsrPI.dll 52.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\IccTest.dll 0.12MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\License.txt 21.99KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\Permission.dll 96.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\ShFolder.Exe 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\_ISTMP3.DIR\_ISTMP0.DIR\value.shl 5.41KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\__ArcadeDownloadFoler__dinerdash_EN_elgoog\RealOneArcadeBundle.exe 16.8MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\__ArcadeDownloadFoler__dinerdash_EN_elgoog\RngcBundler.exe 0.14MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}\pase201winen_US.override 320 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~$RO1762.doc 162 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d429b17d4b91c6c6d3de2bc00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d429b17d4b91c6c6d3de2bc00.jpg 2.34KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d42b515ea2a1c6c980ae113d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d42b515ea2a1c6c980ae113d00.jpg 1.92KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d476516040b1c6c4c035ae0600.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~175d476516040b1c6c4c035ae0600.jpg 2.85KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~1c8eabee1451d1c68de7854cc300.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~1c8eabee1451d1c68de7854cc300.jpg 1.85KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d37f9141c181c6c9fd2cabc000.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d37f9141c181c6c9fd2cabc000.jpg 2.22KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d42a113125d1c6c53d1c4f600.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d42a113125d1c6c53d1c4f600.jpg 2.63KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d474c14c4321c6c45ddcad8600.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~215d474c14c4321c6c45ddcad8600.jpg 2.25KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2660e312c1abe1c67c419750a100.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2660e312c1abe1c67c419750a100.jpg 2.48KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2910bb2b9000361c4e85e63135e00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2910bb2b9000361c4e85e63135e00.jpg 2.47KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d429a12aaae1c6c6cf10431700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d429a12aaae1c6c6cf10431700.jpg 1.37KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d42b4123fb21c6c941abdbbe00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d42b4123fb21c6c941abdbbe00.jpg 1.59KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d476416e2e11c6c4bf94bf4b00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~2f5d476416e2e11c6c4bf94bf4b00.jpg 2.53KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d4289178ed61c6c631fa334900.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d4289178ed61c6c631fa334900.jpg 2.97KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d429a1667951c6c9f564af0500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d429a1667951c6c9f564af0500.jpg 2.61KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d42ae17d5231c6c6f08dcb4f00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~335d42ae17d5231c6c6f08dcb4f00.jpg 1.95KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42891267691c6c632847bad00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42891267691c6c632847bad00.jpg 2.54KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42ae1544511c6c8679eea9c00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42ae1544511c6c8679eea9c00.jpg 1.87KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42b3124aa21c6c667f8847800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d42b3124aa21c6c667f8847800.jpg 2.39KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d474a1649621c6c528d6d0a700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d474a1649621c6c528d6d0a700.jpg 2.25KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47631178621c6c45d3e212500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47631178621c6c45d3e212500.jpg 1.60KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47671348a01c6c45496075e00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d47671348a01c6c45496075e00.jpg 1.83KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d477e1644cf1c6c4af93dbe00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~375d477e1644cf1c6c4af93dbe00.jpg 2.31KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~3860e30ea641b1c67c41928bed00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~3860e30ea641b1c67c41928bed00.jpg 2.07KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~3f5d42bd13ef971c6c629cce29d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~3f5d42bd13ef971c6c629cce29d00.jpg 2.56KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~4260e30e827d41c67c4190299300.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~4260e30e827d41c67c4190299300.jpg 2.19KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d429b13cf431c6c9fccaeb5600.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d429b13cf431c6c9fccaeb5600.jpg 2.24KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d42af1651b11c6c6f359a7900.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d42af1651b11c6c6f359a7900.jpg 2.20KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d474b14a6f81c6c526c6b7c800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d474b14a6f81c6c526c6b7c800.jpg 2.34KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d4766156df31c6c45482f48e00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~435d4766156df31c6c45482f48e00.jpg 1.96KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~455d42bd147f351c6c62142963b00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~455d42bd147f351c6c62142963b00.jpg 2.41KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~460e30e887e21c67c41961f7400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~460e30e887e21c67c41961f7400.jpg 2.59KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~4758eb0a3b81c64bd212f68900.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~4758eb0a3b81c64bd212f68900.jpg 1.59KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~495d42bc1592711c6c629d79d3200.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~495d42bc1592711c6c629d79d3200.jpg 2.23KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~4e60e30f74b291c67c4194ee4700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~4e60e30f74b291c67c4194ee4700.jpg 2.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5060e312cd8b71c67c419c155500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5060e312cd8b71c67c419c155500.jpg 2.12KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d429b15a59c1c6c98bd9e5f000.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d429b15a59c1c6c98bd9e5f000.jpg 2.35KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42af1565c21c6c6ebea783b00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42af1565c21c6c6ebea783b00.jpg 2.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42b6132ae41c6c6328a718e00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~55d42b6132ae41c6c6328a718e00.jpg 2.75KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~575d42a1172aff1c6c5691ae39c00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~575d42a1172aff1c6c5691ae39c00.jpg 2.40KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d429b1426a71c6c9ef81e0d500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d429b1426a71c6c9ef81e0d500.jpg 2.10KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d42af15858d1c6c6ed80f92c00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d42af15858d1c6c6ed80f92c00.jpg 2.03KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d474b16af5e1c6c4c9b7eef800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~5f5d474b16af5e1c6c4c9b7eef800.jpg 2.02KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d42b5142a761c6c86c71ecb800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d42b5142a761c6c86c71ecb800.jpg 1.70KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d474b15725f1c6c4a88580d300.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~615d474b15725f1c6c4a88580d300.jpg 1.32KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6660e327bd5c71c67c419fa8dc00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6660e327bd5c71c67c419fa8dc00.jpg 2.04KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6860e31381e411c67c419881ce00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6860e31381e411c67c419881ce00.jpg 2.16KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d42a013a9751c6c53d13a69900.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d42a013a9751c6c53d13a69900.jpg 2.27KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d474d14395a1c6c49422854100.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~6f5d474d14395a1c6c49422854100.jpg 2.47KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7060e30f8450f1c67c41961f7400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7060e30f8450f1c67c41961f7400.jpg 2.70KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~735d42bc145b891c6c62a42e70400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~735d42bc145b891c6c62a42e70400.jpg 2.60KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7460e30fc12d41c67c4194ee4700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7460e30fc12d41c67c4194ee4700.jpg 2.02KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d428817179f1c6c62fea1a6a00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d428817179f1c6c62fea1a6a00.jpg 2.44KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d429b1444e81c6c9ef87d6b600.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d429b1444e81c6c9ef87d6b600.jpg 1.83KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d42af1714a41c6c6eff0701b00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d42af1714a41c6c6eff0701b00.jpg 1.84KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d474b13f0761c6c4ca3c417b00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~7f5d474b13f0761c6c4ca3c417b00.jpg 2.05KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d429c1499a11c6c6ceb2163400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d429c1499a11c6c6ceb2163400.jpg 1.47KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d42a116d3df1c6c600ede2c800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~835d42a116d3df1c6c600ede2c800.jpg 2.24KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~83601b0fe1f1c6e8b8a23a6400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~83601b0fe1f1c6e8b8a23a6400.jpg 2.89KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~8460e312d5bf51c67c419d468200.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~8460e312d5bf51c67c419d468200.jpg 2.09KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d42b5144e6f1c6c87a8a63cf00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d42b5144e6f1c6c87a8a63cf00.jpg 2.27KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d476517a0241c6c4bf7a856d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~855d476517a0241c6c4bf7a856d00.jpg 2.18KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~895d42b416f62a1c6c95d9b394100.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~895d42b416f62a1c6c95d9b394100.jpg 1.85KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~92f49662148f41c6e8b87fa84b00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~92f49662148f41c6e8b87fa84b00.jpg 3.60KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d4289154c441c6c6318349a00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d4289154c441c6c6318349a00.jpg 2.28KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d42ae1760021c6c6f086a44100.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~95d42ae1760021c6c6f086a44100.jpg 2.03KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42af1424a71c6c6f094f25d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42af1424a71c6c6f094f25d00.jpg 1.67KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42b212e2cf1c6c664531bd500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d42b212e2cf1c6c664531bd500.jpg 2.21KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d474b1290971c6c4ced4d9fa00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d474b1290971c6c4ced4d9fa00.jpg 2.28KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d476213e6031c6c45d2053c000.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d476213e6031c6c45d2053c000.jpg 1.89KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d477f15bdfc1c6c4aef88d4800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~975d477f15bdfc1c6c4aef88d4800.jpg 2.38KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9860e312a46ed1c67c4199b2fb00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9860e312a46ed1c67c4199b2fb00.jpg 2.27KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d429c14a9641c6c6c75b592c00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d429c14a9641c6c6c75b592c00.jpg 1.66KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d42a1139dfa1c6c54773a23d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d42a1139dfa1c6c54773a23d00.jpg 1.67KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d474c14db371c6c4a22f51500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~9f5d474c14db371c6c4a22f51500.jpg 2.11KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~a15d42bd10a8cc1c6c62130b49800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~a15d42bd10a8cc1c6c62130b49800.jpg 2.42KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d429a1108731c6c9ee485b9a00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d429a1108731c6c9ee485b9a00.jpg 1.43KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42ae168b741c6c6ed7c347800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42ae168b741c6c6ed7c347800.jpg 2.13KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b310713a1c6c662e2c08400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b310713a1c6c662e2c08400.jpg 1.77KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b711f4ad1c6c63426e86000.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~af5d42b711f4ad1c6c63426e86000.jpg 2.30KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d429a1454fb1c6c6d052208d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d429a1454fb1c6c6d052208d00.jpg 1.47KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d476416c1b01c6c4c0321a7f00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b35d476416c1b01c6c4c0321a7f00.jpg 2.68KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d429a15a9771c6c6e15d2fe900.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d429a15a9771c6c6e15d2fe900.jpg 2.34KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d42b41653cf1c6c984bc615800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d42b41653cf1c6c984bc615800.jpg 2.45KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d476415ea531c6c4c03cd51400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b75d476415ea531c6c4c03cd51400.jpg 2.96KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b860e312c14211c67c4199b2fb00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~b860e312c14211c67c4199b2fb00.jpg 2.32KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d429c16756a1c6c6cae687f100.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d429c16756a1c6c6cae687f100.jpg 2.41KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d42a115cee91c6c5477866f100.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d42a115cee91c6c5477866f100.jpg 2.27KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d474c16efb11c6c4a2cb3a9d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~bf5d474c16efb11c6c4a2cb3a9d00.jpg 2.59KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c260e312a151a1c67c419881ce00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c260e312a151a1c67c419881ce00.jpg 2.77KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d429b17af651c6c6d5ee995e00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d429b17af651c6c6d5ee995e00.jpg 2.29KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d4765147a821c6c4c039418d00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c35d4765147a821c6c4c039418d00.jpg 3.15KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c55d37f91500681c6c9fd44834400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c55d37f91500681c6c9fd44834400.jpg 2.51KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d429d159d371c6c6cccfa5c00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d429d159d371c6c6cccfa5c00.jpg 2.30KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d42a01715711c6c5477d2ba500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d42a01715711c6c5477d2ba500.jpg 2.23KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d474d1351fa1c6c4a82c18a400.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~c95d474d1351fa1c6c4a82c18a400.jpg 1.55KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ce60e313c173f1c67c419ae42800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ce60e313c173f1c67c419ae42800.jpg 1.91KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~d060e30e6d6201c67c4194ee4700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~d060e30e6d6201c67c4194ee4700.jpg 2.27KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~d75d42bd172dcb1c6c62a47abb800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~d75d42bd172dcb1c6c62a47abb800.jpg 2.69KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF1FC3.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF20F2.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF2587.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF26.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF27FE.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF331E.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF3870.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF3D4D.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF43B3.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF47F2.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF517B.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF58E.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF5B86.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d42b5153d731c6c95d7fce3600.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d42b5153d731c6c95d7fce3600.jpg 2.32KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d474b16beb91c6c4abd3e3a100.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d474b16beb91c6c4abd3e3a100.jpg 2.50KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d476516717a1c6c4c0157e4700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~df5d476516717a1c6c4c0157e4700.jpg 2.24KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF6C73.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF6CA4.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9434.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9815.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DF9E8F.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFA783.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFAD36.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFB848.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFC0BF.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFC187.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFCF25.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD17B.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD285.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFD58A.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFDA34.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFDE06.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFE320.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFEA41.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~DFFD54.tmp 0.11MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d428817184b1c6c62fb2132700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d428817184b1c6c62fb2132700.jpg 2.51KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d42af15795a1c6c6e992d8d000.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d42af15795a1c6c6e992d8d000.jpg 2.17KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d474b1418a81c6c4c0478fa900.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d474b1418a81c6c4c0478fa900.jpg 2.63KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d476211c54e1c6c454a586a700.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e15d476211c54e1c6c454a586a700.jpg 1.86KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e860e30fc7e161c67c4193bd1a00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~e860e30fc7e161c67c4193bd1a00.jpg 1.98KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ef5d42bc1428401c6c625960a8800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ef5d42bc1428401c6c625960a8800.jpg 2.20KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f35d474d1380b11c6c4a84b173600.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f35d474d1380b11c6c4a84b173600.jpg 1.37KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f460e313aa9b71c67c419ae42800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f460e313aa9b71c67c419ae42800.jpg 2.04KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d429d11adb51c6c6ced3772000.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d429d11adb51c6c6ced3772000.jpg 1.46KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d474d13f0c11c6c4a880bc1f00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~f75d474d13f0c11c6c4a880bc1f00.jpg 2.29KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d429b143dd71c6c6cf2bae2200.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d429b143dd71c6c6cf2bae2200.jpg 1.43KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d42b516e7631c6c95d8bb9f800.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d42b516e7631c6c95d8bb9f800.jpg 2.66KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d474b155b991c6c4abd8a85500.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d474b155b991c6c4abd8a85500.jpg 2.31KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d4765165c881c6c4c01911ce00.jpd 21 bytes

C:\DOCUME~1\Jason\LOCALS~1\Temp\~ff5d4765165c881c6c4c01911ce00.jpg 2.95KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRD0000.doc 5.90KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRD0001.doc 18.42KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF0000.tmp 1.09MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF0001.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF1229.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF1538.tmp 16.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRF3741.tmp 2.80MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRL0827.tmp 42.00KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRL2214.tmp 51.50KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0000.tmp 14.67KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0001.tmp 0.25MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0002.tmp 0.19MB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0003.tmp 44.50KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0004.tmp 91.65KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0005.tmp 15.50KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0006.tmp 12.17KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0007.tmp 3.50KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0281.tmp 100.20KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS0491.tmp 82.50KB

C:\DOCUME~1\Jason\LOCALS~1\Temp\~WRS3757.tmp 0.54MB

C:\WINDOWS\MiniDump\Mini032905-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini042506-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini042506-02.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini042606-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini042606-02.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini042706-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini052105-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini052106-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini052106-02.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini052106-03.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini052606-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini080905-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini082405-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini082405-02.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini092105-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini092105-02.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini092905-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini100105-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini100205-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini100205-02.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini100705-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini100805-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini100805-02.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini101005-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini101605-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini101705-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini102005-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102105-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102105-02.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102205-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102305-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini102305-02.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini102305-03.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102305-04.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102405-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102505-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini102605-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini110605-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini110705-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini111005-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini111005-02.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini111005-03.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini112105-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini113005-01.dmp 88.00KB

C:\WINDOWS\MiniDump\Mini120605-01.dmp 64.00KB

C:\WINDOWS\MiniDump\Mini121905-01.dmp 64.00KB

C:\WINDOWS\system32\wbem\Logs\FrameWork.log 65.29KB

C:\WINDOWS\system32\wbem\Logs\mofcomp.log 3.58KB

C:\WINDOWS\system32\wbem\Logs\NTEVT.log 2 bytes

C:\WINDOWS\system32\wbem\Logs\replog.log 401 bytes

C:\WINDOWS\system32\wbem\Logs\setup.log 653 bytes

C:\WINDOWS\system32\wbem\Logs\wbemess.log 52.75KB

C:\WINDOWS\system32\wbem\Logs\wbemprox.log 1.93KB

C:\WINDOWS\system32\wbem\Logs\WBEMSNMP.log 2 bytes

C:\WINDOWS\system32\wbem\Logs\WinMgmt.log 12.71KB

C:\WINDOWS\system32\wbem\Logs\wmiadap.log 2.35KB

C:\WINDOWS\system32\wbem\Logs\wmiprov.log 29.99KB

C:\WINDOWS\system32\wbem\Logs\wbemess.lo_ 64.00KB

C:\WINDOWS\system32\wbem\Logs\wmiprov.lo_ 64.03KB

C:\WINDOWS.log 0 bytes

C:\WINDOWS\cmsetacl.log 200 bytes

C:\WINDOWS\comsetup.log 0.29MB

C:\WINDOWS\dahotfix.log 17.96KB

C:\WINDOWS\DirectX.log 74.09KB

C:\WINDOWS\DtcInstall.log 115 bytes

C:\WINDOWS\FaxSetup.log 1.05MB

C:\WINDOWS\iis6.log 0.17MB

C:\WINDOWS\imsins.log 1.34KB

C:\WINDOWS\KB810217.log 15.05KB

C:\WINDOWS\KB821557.log 10.39KB

C:\WINDOWS\KB823182.log 13.13KB

C:\WINDOWS\KB823559.log 11.09KB

C:\WINDOWS\KB823980.log 11.70KB

C:\WINDOWS\KB824105.log 10.48KB

C:\WINDOWS\KB824141.log 9.01KB

C:\WINDOWS\KB824146.log 12.11KB

C:\WINDOWS\KB825119.log 11.73KB

C:\WINDOWS\KB828028.log 3.55KB

C:\WINDOWS\KB828035.log 8.78KB

C:\WINDOWS\KB828741.log 9.05KB

C:\WINDOWS\KB833987.log 3.35KB

C:\WINDOWS\KB834707.log 7.55KB

C:\WINDOWS\KB835732.log 68.45KB

C:\WINDOWS\KB837001.log 4.79KB

C:\WINDOWS\KB839643-DirectX9.log 2.64KB

C:\WINDOWS\KB839643.log 2.72KB

C:\WINDOWS\KB839645.log 6.08KB

C:\WINDOWS\KB840315.log 5.17KB

C:\WINDOWS\KB840374.log 16.76KB

C:\WINDOWS\KB841873.log 7.28KB

C:\WINDOWS\KB842773.log 5.21KB

C:\WINDOWS\KB867282.log 12.43KB

C:\WINDOWS\KB873333.log 12.64KB

C:\WINDOWS\KB873339.log 0.10MB

C:\WINDOWS\KB883357.log 2.92KB

C:\WINDOWS\KB883939.log 16.69KB

C:\WINDOWS\KB885250.log 16.26KB

C:\WINDOWS\KB885835.log 0.11MB

C:\WINDOWS\KB885836.log 0.10MB

C:\WINDOWS\KB886185.log 0.10MB

C:\WINDOWS\KB887472.log 15.23KB

C:\WINDOWS\KB887742.log 9.46KB

C:\WINDOWS\KB888113.log 15.96KB

C:\WINDOWS\KB888302.log 9.81KB

C:\WINDOWS\KB890046.log 11.29KB

C:\WINDOWS\KB890047.log 10.63KB

C:\WINDOWS\KB890175.log 43.83KB

C:\WINDOWS\KB890859.log 88.92KB

C:\WINDOWS\KB890923.log 91.64KB

C:\WINDOWS\KB891781.log 15.32KB

C:\WINDOWS\KB893066.log 100.19KB

C:\WINDOWS\KB893086.log 87.57KB

C:\WINDOWS\KB893756.log 18.32KB

C:\WINDOWS\KB893803.log 47.30KB

C:\WINDOWS\KB893803v2.log 9.53KB

C:\WINDOWS\KB894391.log 12.82KB

C:\WINDOWS\KB896358.log 11.48KB

C:\WINDOWS\KB896422.log 15.32KB

C:\WINDOWS\KB896423.log 17.62KB

C:\WINDOWS\KB896424.log 11.66KB

C:\WINDOWS\KB896428.log 10.00KB

C:\WINDOWS\KB896688.log 14.25KB

C:\WINDOWS\KB896727.log 18.65KB

C:\WINDOWS\KB898458.log 5.04KB

C:\WINDOWS\KB898461.log 6.72KB

C:\WINDOWS\KB899587.log 18.64KB

C:\WINDOWS\KB899588.log 13.15KB

C:\WINDOWS\KB899591.log 18.21KB

C:\WINDOWS\KB900485.log 11.02KB

C:\WINDOWS\KB900725.log 13.18KB

C:\WINDOWS\KB901017.log 20.46KB

C:\WINDOWS\KB901214.log 9.72KB

C:\WINDOWS\KB902400.log 23.33KB

C:\WINDOWS\KB903235.log 3.74KB

C:\WINDOWS\KB904706.log 10.85KB

C:\WINDOWS\KB905414.log 13.16KB

C:\WINDOWS\KB905749.log 11.54KB

C:\WINDOWS\KB905915.log 16.07KB

C:\WINDOWS\KB908519.log 9.90KB

C:\WINDOWS\KB908531.log 17.86KB

C:\WINDOWS\KB910437.log 9.67KB

C:\WINDOWS\KB911280.log 15.94KB

C:\WINDOWS\KB911562.log 17.04KB

C:\WINDOWS\KB911564.log 8.48KB

C:\WINDOWS\KB911565.log 8.38KB

C:\WINDOWS\KB911567.log 13.10KB

C:\WINDOWS\KB911927.log 10.51KB

C:\WINDOWS\KB912812.log 19.50KB

C:\WINDOWS\KB912919.log 10.85KB

C:\WINDOWS\KB913446.log 6.49KB

C:\WINDOWS\KB913580.log 17.76KB

C:\WINDOWS\KB914388.log 11.97KB

C:\WINDOWS\KB914389.log 11.32KB

C:\WINDOWS\KB916281.log 18.70KB

C:\WINDOWS\KB916595.log 10.17KB

C:\WINDOWS\KB917159.log 11.49KB

C:\WINDOWS\KB917344.log 16.99KB

C:\WINDOWS\KB917422.log 11.64KB

C:\WINDOWS\KB917734.log 14.72KB

C:\WINDOWS\KB917953.log 15.96KB

C:\WINDOWS\KB918118.log 15.54KB

C:\WINDOWS\KB918439.log 16.31KB

C:\WINDOWS\KB918899.log 20.69KB

C:\WINDOWS\KB919007.log 12.90KB

C:\WINDOWS\KB920213.log 24.23KB

C:\WINDOWS\KB920214.log 17.53KB

C:\WINDOWS\KB920670.log 12.28KB

C:\WINDOWS\KB920683.log 11.91KB

C:\WINDOWS\KB920685.log 12.75KB

C:\WINDOWS\KB920872.log 14.51KB

C:\WINDOWS\KB921398.log 18.02KB

C:\WINDOWS\KB921883.log 13.19KB

C:\WINDOWS\KB922582.log 8.97KB

C:\WINDOWS\KB922616.log 17.52KB

C:\WINDOWS\KB922760.log 25.76KB

C:\WINDOWS\KB922819.log 17.22KB

C:\WINDOWS\KB923191.log 13.01KB

C:\WINDOWS\KB923414.log 15.46KB

C:\WINDOWS\KB923689.log 11.38KB

C:\WINDOWS\KB923694.log 11.90KB

C:\WINDOWS\KB923723.log 9.08KB

C:\WINDOWS\KB923980.log 24.65KB

C:\WINDOWS\KB924191.log 17.57KB

C:\WINDOWS\KB924270.log 24.82KB

C:\WINDOWS\KB924496.log 15.45KB

C:\WINDOWS\KB924667.log 13.34KB

C:\WINDOWS\KB925398.log 10.38KB

C:\WINDOWS\KB925454.log 29.48KB

C:\WINDOWS\KB925486.log 12.08KB

C:\WINDOWS\KB926255.log 11.90KB

C:\WINDOWS\KB926436.log 15.25KB

C:\WINDOWS\KB927779.log 19.40KB

C:\WINDOWS\KB927802.log 16.27KB

C:\WINDOWS\KB928090.log 19.15KB

C:\WINDOWS\KB928255.log 16.80KB

C:\WINDOWS\KB928843.log 10.35KB

C:\WINDOWS\KB929338.log 11.78KB

C:\WINDOWS\KB929969.log 10.35KB

C:\WINDOWS\KB931836.log 25.53KB

C:\WINDOWS\msgsocm.log 54.15KB

C:\WINDOWS\nsw.log 489 bytes

C:\WINDOWS\ntdtcsetup.log 0.22MB

C:\WINDOWS\ocgen.log 0.41MB

C:\WINDOWS\ocmsn.log 52.27KB

C:\WINDOWS\Q306583.log 1.31KB

C:\WINDOWS\Q308402.log 4.20KB

C:\WINDOWS\Q308678.log 1.20KB

C:\WINDOWS\Q309521.log 7.85KB

C:\WINDOWS\Q311889.log 4.54KB

C:\WINDOWS\Q311967.log 5.80KB

C:\WINDOWS\Q312368.log 1.76KB

C:\WINDOWS\Q312370.log 3.89KB

C:\WINDOWS\Q313450.log 7.39KB

C:\WINDOWS\Q314147.log 5.85KB

C:\WINDOWS\Q314412.log 944 bytes

C:\WINDOWS\Q314862.log 5.79KB

C:\WINDOWS\Q315000.log 3.24KB

C:\WINDOWS\Q315403.log 2.35KB

C:\WINDOWS\Q317277.log 6.10KB

C:\WINDOWS\Q318138.log 7.12KB

C:\WINDOWS\Q319580.log 7.14KB

C:\WINDOWS\Q323172.log 7.70KB

C:\WINDOWS\Q323255.log 8.31KB

C:\WINDOWS\Q324096.log 8.32KB

C:\WINDOWS\Q324380.log 7.64KB

C:\WINDOWS\Q326147.log 4.17KB

C:\WINDOWS\Q326830.log 8.27KB

C:\WINDOWS\Q328310.log 11.11KB

C:\WINDOWS\Q328940.log 4.20KB

C:\WINDOWS\Q329048.log 8.27KB

C:\WINDOWS\Q329115.log 9.17KB

C:\WINDOWS\Q329170.log 11.07KB

C:\WINDOWS\Q329390.log 8.27KB

C:\WINDOWS\Q329441.log 12.74KB

C:\WINDOWS\Q329834.log 1.57KB

C:\WINDOWS\Q331953.log 23.58KB

C:\WINDOWS\Q810577.log 15.61KB

C:\WINDOWS\Q811493.log 19.24KB

C:\WINDOWS\Q811630.log 19.31KB

C:\WINDOWS\Q815021.log 12.49KB

C:\WINDOWS\Q817606.log 11.53KB

C:\WINDOWS\Q819696.log 11.23KB

C:\WINDOWS\Q828026.log 12.46KB

C:\WINDOWS\regopt.log 3.34KB

C:\WINDOWS\sessmgr.setup.log 3.55KB

C:\WINDOWS\setupact.log 4.64KB

C:\WINDOWS\setupapi.log 0.63MB

C:\WINDOWS\setuperr.log 0 bytes

C:\WINDOWS\spupdsvc.log 30.32KB

C:\WINDOWS\Sti_Trace.log 0 bytes

C:\WINDOWS\svcpack.log 0.49MB

C:\WINDOWS\tsoc.log 0.41MB

C:\WINDOWS\updspapi.log 55.10KB

C:\WINDOWS\vminst.log 2.00KB

C:\WINDOWS\WGA.log 8.30KB

C:\WINDOWS\wiadebug.log 216 bytes

C:\WINDOWS\wiaservc.log 50 bytes

C:\WINDOWS\Windows Update.log 0.20MB

C:\WINDOWS\wmsetup.log 79.27KB

C:\WINDOWS\xpsp1hfm.log 0.15MB

C:\WINDOWS\yacs.log 392 bytes

C:\WINDOWS\imsins.BAK 1.34KB

C:\WINDOWS\IE4 Error Log.txt 240 bytes

C:\WINDOWS\ntbtlog.txt 76.26KB

C:\WINDOWS\OEWABLog.txt 345 bytes

C:\WINDOWS\ReportMaker Plus Setup Log.txt 180 bytes

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log 44.3MB

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp 53.16KB

C:\WINDOWS\Debug\blastcln.log 286 bytes

C:\WINDOWS\Debug\mrt.log 18.64KB

C:\WINDOWS\Debug\NetSetup.LOG 6.91KB

C:\WINDOWS\security\logs\backup.log 2.87KB

C:\WINDOWS\security\logs\convert.log 3.37KB

C:\WINDOWS\security\logs\SceRoot.log 216 bytes

C:\WINDOWS\security\logs\scesetup.log 0.11MB

C:\WINDOWS\security\logs\scesrv.log 526 bytes

C:\WINDOWS\security\logs\update.log 6.99KB

C:\WINDOWS\security\logs\scecomp.old 2.42KB

------------------------------------------------------------------------------------------

Share this post


Link to post
Share on other sites

Sadly, no.

 

A window still pops up upon statrup that says my homepage is trying to be changed to messengersite.net

 

And HiJackThis still shuts down within seconds of starting.

 

Tricky Tricky eh?

 

Regards,

 

Jason

Share this post


Link to post
Share on other sites

Hi,Jason86

 

Hmm without seeing a HijackThis, let's try something here

 

Please Download MsnVirRem.exe to your desktop from one of the following mirrors.

Mirror 1

Mirror 2

First close any other programs you have running as this will require a reboot

Double click MsnVirRem.exe to run it

Once open, click the button labelled "Search and Destroy"

<<Your computer will now be scanned for Infected Files>>

When scanning is finished you will be prompted to reboot only if infected, Click OK

Now click the "REBOOT" Button.

After the Reboot, you WILL receive file not found errors (usually 4) please acknowledge them and continue.

A Message should popup from MsnVirRem if not, double click the program again and it will finish

 

Please Post the contents of C:\msnvirrem.log along with a fresh HijackThis log

 

--------------

 

Also run this tool for me as well.

 

Please download ComboFix and save it to your desktop.

 

Double click combofix.exe and follow the prompts.

 

When it's done running it will produce a log for you. Please post that log in your next reply.

 

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

 

---------------

 

Then come back here with all logfiles.

 

Gogo ;)

Share this post


Link to post
Share on other sites

"Jason" - 07-03-24 12:42:46 Service Pack 2

ComboFix 07-03-23 - Running from: "C:\Documents and Settings\Jason\Desktop"

 

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

 

 

C:\WINDOWS\system32\netstat.com

C:\WINDOWS\system32\taskkill.com

 

 

((((((((((((((((((((((((((((((( Files Created from 2007-02-24 to 2007-03-24 ))))))))))))))))))))))))))))))))))

 

 

2007-03-23 11:51 <DIR> d-------- C:\Program Files\CCleaner

2007-03-23 02:14 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2007-03-23 02:14 <DIR> d-------- C:\DOCUME~1\Jason\APPLIC~1\SUPERAntiSpyware.com

2007-03-23 02:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com

2007-03-21 23:59 <DIR> d-------- C:\HJT

2007-03-20 17:06 <DIR> d-------- C:\DOCUME~1\Jason\APPLIC~1\Lavasoft

2007-03-08 16:14 <DIR> d--hs---- C:\WINDOWS\system32\nsgmgvmq

 

 

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

 

 

2007-03-23 11:40 -------- d-------- C:\Program Files\hbinst

2007-03-23 02:13 -------- d-------- C:\Program Files\Common Files\wise installation wizard

2007-03-20 18:36 -------- d--h----- C:\Program Files\sysai

2007-03-20 18:36 -------- d-------- C:\Program Files\gramuser

2007-03-20 17:06 -------- d-------- C:\Program Files\lavasoft

2007-03-14 19:30 -------- d-------- C:\Program Files\messenger

2007-03-08 16:25 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys

 

 

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]

@=""

"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"

"EPSON Stylus C84 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2D1.EXE /P23 \"EPSON Stylus C84 Series\" /M \"Stylus C84\" /EF \"HKCU\""

"Free Download Manager"="C:\\Program Files\\Free Download Manager\\fdm.exe -autorun"

"csrss"=""

"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

"vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe"

"EPSON Stylus C84 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2D1.EXE /P23 \"EPSON Stylus C84 Series\" /O6 \"USB001\" /M \"Stylus C84\""

"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe"

"MoneyStartUp10.0"="\"c:\\Program Files\\Microsoft Money\\System\\Activation.exe\""

"REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN"

"OrderReminder"="C:\\Program Files\\Hewlett-Packard\\OrderReminder\\OrderReminder.exe"

"csrss"=""

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\Compaq]

"SetRefresh"="C:\\Program Files\\Compaq\\SetRefresh\\SetRefresh.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]

"Installed"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]

"NoChange"="1"

"Installed"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]

"Installed"="1"

 

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"="1"

"NoAdminPage"="1"

 

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]

LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\

NetworkService REG_MULTI_SZ DnsCache\

rpcss REG_MULTI_SZ RpcSs\

imgsvc REG_MULTI_SZ StiSvc\

termsvcs REG_MULTI_SZ TermService\

HTTPFilter REG_MULTI_SZ HTTPFilter\

DcomLaunch REG_MULTI_SZ DcomLaunchTermService\

 

*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_NMSCFG

 

 

Contents of the 'Scheduled Tasks' folder

C:\WINDOWS\tasks\Registration reminder 1.job

C:\WINDOWS\tasks\Registration reminder 2.job

C:\WINDOWS\tasks\Registration reminder 3.job

 

 

********************************************************************

 

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006

http://www.gmer.net

 

scanning hidden processes ...

 

scanning hidden services ...

 

scanning hidden autostart entries ...

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

EPSON Stylus C84 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"???????>???_???????o????????????a?w&????????????????????????????????????b?w????????????????8???????????h??w????????????z??w????????????)??|???????

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

EPSON Stylus C84 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"???????>???_???????o????????????a?w&????????????????????????????????????b?w????????????????8???????????h??w????????????z??w????????????)??|???????

 

scanning hidden files ...

 

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

 

********************************************************************

 

Completion time: 07-03-24 12:50:46

Share this post


Link to post
Share on other sites

Hi,Jason86

 

Download The Avenger Copyright © Swandog46

You must extract avenger.exe to your desktop, before you run it.

 

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

 

 

Copy all the text contained in the code box below to your Clipboard.

NOTE: don't copy the word quote

 

Files to delete:

C:\WINDOWS\system32\nsgmgvmq

C:\Program Files\hbinst

C:\Program Files\sysai

 

The above script is for this user only, if you need help please start your own thread.

 

Start the Avenger.

Under "Script file to execute" choose "Input Script Manually".

Click on the Magnifying Glass icon which will open a new window titled "View/edit script".

Paste the entire text in into this window.

Click done, now click on the Green Light

Answer "Yes" twice when prompted.

Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.

 

After the restart, it will create a log file that should open.

This log file will be located at C:\avenger.txt

 

Paste the contents of C:\avenger.txt into your reply along with a fresh HijackThis! log.

 

Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.

 

----------------

 

Then after reboot see if you can run this tool here.

 

Download to your desktop http://www.malekal.com/download/clean.zip, and right click to allow it to create it's own "clean" folder. In that folder click on clean.cmd. When the command window (black screen) opens select option 1 (and Enter). Allow the scan to complete, press any key and post the contents of the text popup back here please.

 

----------------

 

Then come back here with all logfiles.

 

Gogo ;)

Share this post


Link to post
Share on other sites

Logfile of The Avenger version 1, by Swandog46

Running from registry key:

\Registry\Machine\System\CurrentControlSet\Services\cxwmxtqe

 

*******************

 

Script file located at: \??\C:\tbsarpjh.txt

Script file opened successfully.

 

Script file read successfully

 

Backups directory opened successfully at C:\Avenger

 

*******************

 

Beginning to process script file:

 

 

 

Error: C:\WINDOWS\system32\nsgmgvmq is a folder, not a file!

Deletion of file C:\WINDOWS\system32\nsgmgvmq failed!

 

Could not process line:

C:\WINDOWS\system32\nsgmgvmq

Status: 0xc00000ba

 

 

 

Error: C:\Program Files\hbinst is a folder, not a file!

Deletion of file C:\Program Files\hbinst failed!

 

Could not process line:

C:\Program Files\hbinst

Status: 0xc00000ba

 

 

 

Error: C:\Program Files\sysai is a folder, not a file!

Deletion of file C:\Program Files\sysai failed!

 

Could not process line:

C:\Program Files\sysai

Status: 0xc00000ba

 

 

Completed script processing.

 

 

 

 

 

 

 

 

Rapport clean par Malekal_morte - http://www.malekal.com

Option 1, executee le 25/03/2007 a 6:10:10.34

 

*** Recherche de fichiers sur C:

 

*** Recherche des fichiers dans C:\WINDOWS\

 

*** Recherche des fichiers dans C:\WINDOWS\system32

C:\WINDOWS\System32\taskkill.com FOUND

C:\WINDOWS\System32\netstat.com FOUND

C:\WINDOWS\system32\f3PSSavr.scr FOUND

 

"C:\Program Files\funwebproducts\" FOUND

"C:\Program Files\hbinst\" FOUND

"C:\Program Files\msn messenger\riched20.dll" FOUND

"C:\Program Files\MyWebSearch\" FOUND

*** Fin du rapport !

Share this post


Link to post
Share on other sites

Hi,Jason86

 

Please try this again

 

Download The Avenger Copyright © Swandog46

You must extract avenger.exe to your desktop, before you run it.

 

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

 

 

Copy all the text contained in the code box below to your Clipboard.

NOTE: don't copy the word quote

 

Files to delete:

C:\WINDOWS\System32\taskkill.com

C:\WINDOWS\System32\netstat.com

C:\WINDOWS\system32\f3PSSavr.scr

 

Folders to delete:

C:\Program Files\funwebproducts

C:\Program Files\hbinst

C:\Program Files\MyWebSearch

C:\Program Files\sysai

C:\WINDOWS\system32\nsgmgvmq

 

The above script is for this user only, if you need help please start your own thread.

 

Start the Avenger.

Under "Script file to execute" choose "Input Script Manually".

Click on the Magnifying Glass icon which will open a new window titled "View/edit script".

Paste the entire text in into this window.

Click done, now click on the Green Light

Answer "Yes" twice when prompted.

Your computer shoud reboot, and briefly open a black command window on your desktop, this is normal.

 

After the restart, it will create a log file that should open.

This log file will be located at C:\avenger.txt

 

Paste the contents of C:\avenger.txt into your reply along with a fresh HijackThis! log.

 

Also: Avenger has made backups of all the files, etc., that you asked it to delete, located at C:\avenger\backup.zip.

 

----------------

 

Then do a reboot come back here with new HijackThis logfile and avenger.txt

 

 

Gogo :D

Share this post


Link to post
Share on other sites

Logfile of The Avenger version 1, by Swandog46

Running from registry key:

\Registry\Machine\System\CurrentControlSet\Services\iwofsqrk

 

*******************

 

Script file located at: \??\C:\WINDOWS\system32\usviuehm.txt

Script file opened successfully.

 

Script file read successfully

 

Backups directory opened successfully at C:\Avenger

 

*******************

 

Beginning to process script file:

 

File C:\WINDOWS\System32\taskkill.com deleted successfully.

File C:\WINDOWS\System32\netstat.com deleted successfully.

File C:\WINDOWS\system32\f3PSSavr.scr deleted successfully.

Folder C:\Program Files\funwebproducts deleted successfully.

Folder C:\Program Files\hbinst deleted successfully.

Folder C:\Program Files\MyWebSearch deleted successfully.

Folder C:\Program Files\sysai deleted successfully.

Folder C:\WINDOWS\system32\nsgmgvmq deleted successfully.

 

Completed script processing.

 

*******************

 

Finished! Terminate.

 

 

AHHHH!!!! Finally able to run HiJackThis!!!!!!!!

 

 

Logfile of HijackThis v1.99.1

Scan saved at 2:56:26 AM, on 26/03/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\System32\NMSSvc.exe

C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe

C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Jason\My Documents\Jason's Folder\Gonow.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe

F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe

O1 - Hosts: 1.1.1.1 f-secure.com

O1 - Hosts: 1.1.1.1 www.f-secure.com

O1 - Hosts: 1.1.1.1 ftp.f-secure.com

O1 - Hosts: 1.1.1.1 ftp.sophos.com

O1 - Hosts: 1.1.1.1 liveupdate.symantec.com

O1 - Hosts: 1.1.1.1 customer.symantec.com

O1 - Hosts: 1.1.1.1 dispatch.mcafee.com

O1 - Hosts: 1.1.1.1 download.mcafee.com

O1 - Hosts: 1.1.1.1 rads.mcafee.com

O1 - Hosts: 1.1.1.1 mast.mcafee.com

O1 - Hosts: 1.1.1.1 my-etrust.com

O1 - Hosts: 1.1.1.1 www.my-etrust.com

O1 - Hosts: 1.1.1.1 nai.com

O1 - Hosts: 1.1.1.1 www.nai.com

O1 - Hosts: 1.1.1.1 networkassociates.com

O1 - Hosts: 1.1.1.1 secure.nai.com

O1 - Hosts: 1.1.1.1 securityresponse.symantec.com

O1 - Hosts: 1.1.1.1 service1.symantec.com

O1 - Hosts: 1.1.1.1 sophos.com

O1 - Hosts: 1.1.1.1 www.sophos.com

O1 - Hosts: 1.1.1.1 support.microsoft.com

O1 - Hosts: 1.1.1.1 symantec.com

O1 - Hosts: 1.1.1.1 www.symantec.com

O1 - Hosts: 1.1.1.1 update.symantec.com

O1 - Hosts: 1.1.1.1 updates.symantec.com

O1 - Hosts: 1.1.1.1 us.mcafee.com

O1 - Hosts: 1.1.1.1 vil.nai.com

O1 - Hosts: 1.1.1.1 viruslist.com

O1 - Hosts: 1.1.1.1 www.viruslist.com

O1 - Hosts: 1.1.1.1 grisoft.com

O1 - Hosts: 1.1.1.1 www.grisoft.com

O1 - Hosts: 1.1.1.1 free.grisoft.com

O1 - Hosts: 1.1.1.1 trendmicro.com

O1 - Hosts: 1.1.1.1 housecall.trendmicro.com

O1 - Hosts: 1.1.1.1 www.trendmicro.com

O1 - Hosts: 1.1.1.1 pandasoftware.com

O1 - Hosts: 1.1.1.1 www.pandasoftware.com

O1 - Hosts: 1.1.1.1 usa.kaspersky.com

O1 - Hosts: 1.1.1.1 ewido.net

O1 - Hosts: 1.1.1.1 www.ewido.net

O1 - Hosts: 1.1.1.1 zonelabs.com

O1 - Hosts: 1.1.1.1 www.zonelabs.com

O1 - Hosts: 1.1.1.1 bitdefender.com

O1 - Hosts: 1.1.1.1 www.bitdefender.com

O1 - Hosts: 1.1.1.1 download.bitdefender.com

O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com

O1 - Hosts: 1.1.1.1

O1 - Hosts: 1.1.1.1

O1 - Hosts: 1.1.1.1 merijn.org

O1 - Hosts: 1.1.1.1 www.merijn.org

O1 - Hosts: 1.1.1.1 sysinternals.com

O1 - Hosts: 1.1.1.1 www.sysinternals.com

O1 - Hosts: 1.1.1.1 onguardonline.gov

O1 - Hosts: 1.1.1.1 www.onguardonline.gov

O1 - Hosts: 1.1.1.1 avast.com

O1 - Hosts: 1.1.1.1 www.avast.com

O1 - Hosts: 1.1.1.1 safety.live.com

O1 - Hosts: 1.1.1.1 www.paretologic.com

O1 - Hosts: 1.1.1.1 paretologic.com

O1 - Hosts: 1.1.1.1 virusscan.jotti.org

O1 - Hosts: 1.1.1.1 services.google.com

O1 - Hosts: 1.1.1.1 www.webroot.com

O1 - Hosts: 1.1.1.1 webroot.com

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe

O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"

O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: csrss.lnk = ?

O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Startup: PowerReg Scheduler.exe

O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Global Startup: Picture Package Menu.lnk = ?

O4 - Global Startup: Picture Package VCD Maker.lnk = ?

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA

O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll

O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab

O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll

O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

Share this post


Link to post
Share on other sites

Hi,Jason86

 

Yes this is good now let's move on

 

Go to Start | Control Panel | Add/Remove Programs and remove the following (if they exist):

MyWebSearch

VBouncer

 

Note: Please that these items may need you to do a reboot to complete the Uninstall then please do so.

 

----------------

 

Please Download MsnVirRem.exe to your desktop from one of the following mirrors.

Mirror 1

Mirror 2

First close any other programs you have running as this will require a reboot

Double click MsnVirRem.exe to run it

Once open, click the button labelled "Search and Destroy"

<<Your computer will now be scanned for Infected Files>>

When scanning is finished you will be prompted to reboot only if infected, Click OK

Now click the "REBOOT" Button.

After the Reboot, you WILL receive file not found errors (usually 4) please acknowledge them and continue.

A Message should popup from MsnVirRem if not, double click the program again and it will finish

 

Please Post the contents of C:\msnvirrem.log along with a fresh HijackThis log

 

---------------

 

View hidden files and folders:

Click Start.

Open My Computer.

Select the Tools menu and click Folder Options.

Select the View Tab.

Under the Hidden files and folders heading select Show hidden files and folders.

Uncheck the Hide protected operating system files (recommended) option.

Click Yes to confirm.

Click OK.

 

---------------

 

Run HijackThis

Scan and when it finishes, put a check mark only next to these following items : (if present)

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

 

F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe

F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe

 

O1 - Hosts: 1.1.1.1 f-secure.com

 

O1 - Hosts: 1.1.1.1 www.f-secure.com

 

O1 - Hosts: 1.1.1.1 ftp.f-secure.com

 

O1 - Hosts: 1.1.1.1 ftp.sophos.com

 

O1 - Hosts: 1.1.1.1 liveupdate.symantec.com

 

O1 - Hosts: 1.1.1.1 customer.symantec.com

 

O1 - Hosts: 1.1.1.1 dispatch.mcafee.com

 

O1 - Hosts: 1.1.1.1 download.mcafee.com

 

O1 - Hosts: 1.1.1.1 rads.mcafee.com

 

O1 - Hosts: 1.1.1.1 mast.mcafee.com

 

O1 - Hosts: 1.1.1.1 my-etrust.com

 

O1 - Hosts: 1.1.1.1 www.my-etrust.com

 

O1 - Hosts: 1.1.1.1 nai.com

 

O1 - Hosts: 1.1.1.1 www.nai.com

 

O1 - Hosts: 1.1.1.1 networkassociates.com

 

O1 - Hosts: 1.1.1.1 secure.nai.com

 

O1 - Hosts: 1.1.1.1 securityresponse.symantec.com

 

O1 - Hosts: 1.1.1.1 service1.symantec.com

 

O1 - Hosts: 1.1.1.1 sophos.com

 

O1 - Hosts: 1.1.1.1 www.sophos.com

 

O1 - Hosts: 1.1.1.1 support.microsoft.com

 

O1 - Hosts: 1.1.1.1 symantec.com

 

O1 - Hosts: 1.1.1.1 www.symantec.com

 

O1 - Hosts: 1.1.1.1 update.symantec.com

 

O1 - Hosts: 1.1.1.1 updates.symantec.com

 

O1 - Hosts: 1.1.1.1 us.mcafee.com

 

O1 - Hosts: 1.1.1.1 vil.nai.com

 

O1 - Hosts: 1.1.1.1 viruslist.com

 

O1 - Hosts: 1.1.1.1 www.viruslist.com

 

O1 - Hosts: 1.1.1.1 grisoft.com

 

O1 - Hosts: 1.1.1.1 www.grisoft.com

 

O1 - Hosts: 1.1.1.1 free.grisoft.com

 

O1 - Hosts: 1.1.1.1 trendmicro.com

 

O1 - Hosts: 1.1.1.1 housecall.trendmicro.com

 

O1 - Hosts: 1.1.1.1 www.trendmicro.com

 

O1 - Hosts: 1.1.1.1 pandasoftware.com

 

O1 - Hosts: 1.1.1.1 www.pandasoftware.com

 

O1 - Hosts: 1.1.1.1 usa.kaspersky.com

 

O1 - Hosts: 1.1.1.1 ewido.net

 

O1 - Hosts: 1.1.1.1 www.ewido.net

 

O1 - Hosts: 1.1.1.1 zonelabs.com

 

O1 - Hosts: 1.1.1.1 www.zonelabs.com

 

O1 - Hosts: 1.1.1.1 bitdefender.com

 

O1 - Hosts: 1.1.1.1 www.bitdefender.com

 

O1 - Hosts: 1.1.1.1 download.bitdefender.com

 

O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com

 

O1 - Hosts: 1.1.1.1

 

O1 - Hosts: 1.1.1.1

 

O1 - Hosts: 1.1.1.1 merijn.org

 

O1 - Hosts: 1.1.1.1 www.merijn.org

 

O1 - Hosts: 1.1.1.1 sysinternals.com

 

O1 - Hosts: 1.1.1.1 www.sysinternals.com

 

O1 - Hosts: 1.1.1.1 onguardonline.gov

 

O1 - Hosts: 1.1.1.1 www.onguardonline.gov

 

O1 - Hosts: 1.1.1.1 avast.com

 

O1 - Hosts: 1.1.1.1 www.avast.com

 

O1 - Hosts: 1.1.1.1 safety.live.com

 

O1 - Hosts: 1.1.1.1 www.paretologic.com

 

O1 - Hosts: 1.1.1.1 paretologic.com

 

O1 - Hosts: 1.1.1.1 virusscan.jotti.org

 

O1 - Hosts: 1.1.1.1 services.google.com

 

O1 - Hosts: 1.1.1.1 www.webroot.com

 

O1 - Hosts: 1.1.1.1 webroot.com

 

O4 - Startup: csrss.lnk = ?

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Startup: PowerReg Scheduler.exe

O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

 

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA

 

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

 

Close all browsers and any open Windows, making sure that only HijackThis is open

Click Fix Checked

Close HijackThis

 

---------------

 

Using Windows Explorer (right-click your Start button and select Explore), please navigate to and delete the following FILES, FOLDERS (if they exist):

C:\Program Files\MyWebSearch\<---This folder

C:\Program Files\VBouncer\<---This folder

 

----------------

 

You're using an outdated version of Java (latest one is Java Runtime Environment (JRE) 6). Please update and remove the older versions. Do the following:

Go to Start | Control Panel | Add/Remove Programs

Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )

It should have this icon next to it: javaicon.gif

Select it and click Remove.

Then download and install the newest version from here (scroll down to find it):

Java Runtime Environment (JRE) 6

 

----------------

 

Do a reboot come back here with new HijackThis logfile and feedback as to how PC is doing.

 

 

Gogo :unsure:

Share this post


Link to post
Share on other sites

"Go to Start | Control Panel | Add/Remove Programs and remove the following (if they exist):

MyWebSearch

VBouncer"

 

I dont have those programs on the Add/Remove Programs List.

 

 

MsnVirRem.exe stalls (Not Responding) everytime I try to use it.

 

 

Should I continue with the next instructions?

Share this post


Link to post
Share on other sites

Hey,Jason86

 

No please show me a new HijackThis logfile just to make sure something new

did not get on the PC.

 

Gogo :D

Share this post


Link to post
Share on other sites

Logfile of HijackThis v1.99.1

Scan saved at 4:06:48 PM, on 02/04/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\System32\NMSSvc.exe

C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE

C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe

C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\FirstClass\fcc32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Microsoft Office\Office\WINWORD.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Jason\My Documents\Jason's Folder\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

F3 - REG:win.ini: load=C:\WINDOWS\system32\nsgmgvmq\csrss.exe

F3 - REG:win.ini: run=C:\WINDOWS\system32\nsgmgvmq\csrss.exe

O1 - Hosts: 1.1.1.1 f-secure.com

O1 - Hosts: 1.1.1.1 www.f-secure.com

O1 - Hosts: 1.1.1.1 ftp.f-secure.com

O1 - Hosts: 1.1.1.1 ftp.sophos.com

O1 - Hosts: 1.1.1.1 liveupdate.symantec.com

O1 - Hosts: 1.1.1.1 customer.symantec.com

O1 - Hosts: 1.1.1.1 dispatch.mcafee.com

O1 - Hosts: 1.1.1.1 download.mcafee.com

O1 - Hosts: 1.1.1.1 rads.mcafee.com

O1 - Hosts: 1.1.1.1 mast.mcafee.com

O1 - Hosts: 1.1.1.1 my-etrust.com

O1 - Hosts: 1.1.1.1 www.my-etrust.com

O1 - Hosts: 1.1.1.1 nai.com

O1 - Hosts: 1.1.1.1 www.nai.com

O1 - Hosts: 1.1.1.1 networkassociates.com

O1 - Hosts: 1.1.1.1 secure.nai.com

O1 - Hosts: 1.1.1.1 securityresponse.symantec.com

O1 - Hosts: 1.1.1.1 service1.symantec.com

O1 - Hosts: 1.1.1.1 sophos.com

O1 - Hosts: 1.1.1.1 www.sophos.com

O1 - Hosts: 1.1.1.1 support.microsoft.com

O1 - Hosts: 1.1.1.1 symantec.com

O1 - Hosts: 1.1.1.1 www.symantec.com

O1 - Hosts: 1.1.1.1 update.symantec.com

O1 - Hosts: 1.1.1.1 updates.symantec.com

O1 - Hosts: 1.1.1.1 us.mcafee.com

O1 - Hosts: 1.1.1.1 vil.nai.com

O1 - Hosts: 1.1.1.1 viruslist.com

O1 - Hosts: 1.1.1.1 www.viruslist.com

O1 - Hosts: 1.1.1.1 grisoft.com

O1 - Hosts: 1.1.1.1 www.grisoft.com

O1 - Hosts: 1.1.1.1 free.grisoft.com

O1 - Hosts: 1.1.1.1 trendmicro.com

O1 - Hosts: 1.1.1.1 housecall.trendmicro.com

O1 - Hosts: 1.1.1.1 www.trendmicro.com

O1 - Hosts: 1.1.1.1 pandasoftware.com

O1 - Hosts: 1.1.1.1 www.pandasoftware.com

O1 - Hosts: 1.1.1.1 usa.kaspersky.com

O1 - Hosts: 1.1.1.1 ewido.net

O1 - Hosts: 1.1.1.1 www.ewido.net

O1 - Hosts: 1.1.1.1 zonelabs.com

O1 - Hosts: 1.1.1.1 www.zonelabs.com

O1 - Hosts: 1.1.1.1 bitdefender.com

O1 - Hosts: 1.1.1.1 www.bitdefender.com

O1 - Hosts: 1.1.1.1 download.bitdefender.com

O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com

 

 

O1 - Hosts: 1.1.1.1 merijn.org

O1 - Hosts: 1.1.1.1 www.merijn.org

O1 - Hosts: 1.1.1.1 sysinternals.com

O1 - Hosts: 1.1.1.1 www.sysinternals.com

O1 - Hosts: 1.1.1.1 onguardonline.gov

O1 - Hosts: 1.1.1.1 www.onguardonline.gov

O1 - Hosts: 1.1.1.1 avast.com

O1 - Hosts: 1.1.1.1 www.avast.com

O1 - Hosts: 1.1.1.1 safety.live.com

O1 - Hosts: 1.1.1.1 www.paretologic.com

O1 - Hosts: 1.1.1.1 paretologic.com

O1 - Hosts: 1.1.1.1 virusscan.jotti.org

O1 - Hosts: 1.1.1.1 services.google.com

O1 - Hosts: 1.1.1.1 www.webroot.com

O1 - Hosts: 1.1.1.1 webroot.com

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar1.02.5000.1021\en-ca\msntb.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe

O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"

O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Startup: csrss.lnk = ?

O4 - Startup: Epson printer Registration.lnk = D:\titles\ereg\EPSONREG.EXE

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Startup: PowerReg Scheduler.exe

O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Global Startup: Picture Package Menu.lnk = ?

O4 - Global Startup: Picture Package VCD Maker.lnk = ?

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYCA

O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll

O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=1009

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...tup1.0.0.15.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab

O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll

O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

Share this post


Link to post
Share on other sites
Sign in to follow this