What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] win32/Rootkit.Agent.NIJ trojan

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
HI I'm new here. been reading your forums and Ii;ve tride some of the self help and things to do before posting a scan.. my internet connection is slow these past few days and ive decided to run "Super Anit Spyware" to check for spywares then my computer goes to BSOD(blue screen of death) error 0x00000050. ive tried using the malware and found two infections trojan and rootkit Malwarebytes' Anti-Malware 1.42 Database version: 3416 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 12/24/2009 9:40:36 AM mbam-log-2009-12-24 (09-40-36).txt Scan type: Quick Scan Objects scanned: 131584 Time elapsed: 9 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\synsend (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\Drivers\str.sys (Rootkit.Agent) -> Delete on reboot. …………………………………………………………………….. …………………………… just want to ask if I'm clean of these infections or not? hope you could help me with this…
Post #2
[external image: Posted Image]


DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.



Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Note: Combofix will run without the Recovery Console installed.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
Post #3
hi…

here's the log

cflog

ComboFix 09-12-27.04 - user 12/29/2009 8:33.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1679 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-0791611581-8667732377-999493845-8046
c:\recycler\S-1-5-21-6502955261-5037185999-681892537-0520
c:\windows\system32\config\systemprofile\reader_s.exe
c:\windows\system32\ctfmon .exe
c:\windows\system32\Data
c:\windows\system32\drivers\str.sys
c:\windows\system32\drivers\zswdugxewthq.sys
c:\windows\system32\reader_s.exe

c:\windows\system32\DRIVERS\atapi.sys . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_SYNSEND
——-\Service_synsend
——-\Legacy_tyamhmo
——-\Service_tyamhmo


((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-29 )))))))))))))))))))))))))))))))
.

2009-12-25 04:03 . 2009-06-30 17:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2009-12-25 04:01 . 2009-12-25 04:01 ——– d—–w- c:\program files\Panda Security
2009-12-24 09:34 . 2009-12-24 09:34 ——– d—–w- c:\documents and settings\user\Application Data\Malwarebytes
2009-12-24 09:32 . 2009-12-04 00:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 09:32 . 2009-12-24 09:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-24 09:32 . 2009-12-24 09:34 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 09:32 . 2009-12-04 00:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 09:27 . 2009-12-24 09:28 ——– d—–w- c:\program files\ERUNT
2009-12-24 05:08 . 2009-12-24 05:08 117760 —-a-w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-24 00:11 . 2009-12-24 00:11 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-12-24 00:11 . 2009-12-24 00:11 ——– d—–w- c:\documents and settings\user\Local Settings\Application Data\SupportSoft
2009-12-24 00:11 . 2009-12-24 00:11 ——– d—–w- c:\program files\Common Files\SupportSoft
2009-12-24 00:11 . 2009-12-24 00:11 ——– d—–w- c:\documents and settings\All Users\Application Data\SupportSoft
2009-12-24 00:10 . 2009-12-24 00:10 ——– d—–w- c:\program files\Globe Telecom
2009-12-23 00:00 . 2009-12-23 00:00 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-12-22 23:59 . 2009-12-22 23:59 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-12-21 03:11 . 2009-12-21 03:11 ——– d—–w- C:\CFLog
2009-12-21 01:19 . 2001-08-18 06:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2009-12-21 01:19 . 2004-08-04 08:56 159232 —-a-w- c:\windows\system32\ptpusd.dll
2009-12-21 01:19 . 2004-08-04 06:58 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2009-12-21 01:19 . 2004-08-04 06:58 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2009-12-06 13:19 . 2009-12-06 13:19 ——– d—–w- c:\windows\Sun
2009-12-05 19:49 . 2009-12-05 19:49 ——– d-sh–w- c:\documents and settings\user\PrivacIE
2009-12-05 19:34 . 2009-12-05 19:34 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-12-05 19:29 . 2009-12-05 19:29 ——– d-sh–w- c:\documents and settings\user\IETldCache
2009-12-05 19:28 . 2009-12-05 19:28 ——– d—–w- c:\windows\ie8updates
2009-12-05 19:26 . 2009-12-05 19:27 ——– dc-h–w- c:\windows\ie8
2009-12-05 19:16 . 2009-12-05 19:28 ——– d–h–w- c:\windows\$hf_mig$
2009-12-05 19:12 . 2009-10-02 04:44 92160 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2009-12-05 19:12 . 2009-08-29 08:08 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2009-12-05 19:12 . 2009-08-29 08:08 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-12-05 19:12 . 2009-08-29 08:08 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2009-12-05 19:12 . 2009-08-29 08:08 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2009-12-05 19:12 . 2009-08-29 08:08 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-05 19:12 . 2009-08-29 08:08 11069440 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2009-12-05 06:24 . 2009-12-05 06:24 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-05 06:23 . 2009-12-05 06:23 ——– d—–w- c:\program files\Java
2009-12-05 06:23 . 2009-12-05 06:23 152576 —-a-w- c:\documents and settings\user\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-12-03 13:14 . 2009-12-03 13:14 ——– d–h–w- c:\windows\PIF
2009-12-02 06:45 . 2009-12-02 06:45 ——– d—–w- c:\documents and settings\user\Application Data\Orneon
2009-12-02 02:17 . 2009-12-20 05:20 ——– d—–w- c:\documents and settings\user\Application Data\Pharaohs Secret
2009-12-02 02:17 . 2009-12-02 02:17 ——– d—–w- c:\program files\SpintopGames
2009-12-01 14:12 . 2009-12-01 14:12 ——– d—–w- C:\UT2004
2009-12-01 06:42 . 2009-12-01 06:42 ——– d—–w- c:\documents and settings\user\Application Data\Autodesk
2009-11-30 04:37 . 2009-11-30 04:37 ——– d—–w- c:\program files\Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 07:52 . 2009-09-10 17:20 ——– d—–w- c:\program files\MYGAME Launcher
2009-12-26 17:05 . 2009-07-18 08:01 ——– d—–w- c:\documents and settings\user\Application Data\Wildfire
2009-12-24 05:07 . 2009-11-01 20:06 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-12-24 05:07 . 2009-11-01 20:06 ——– d—–w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com
2009-12-24 05:07 . 2009-03-31 16:27 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-24 04:40 . 2009-11-27 04:01 ——– d—–w- c:\documents and settings\user\Application Data\BitTorrent
2009-12-20 17:29 . 2009-03-31 02:58 26 —-a-w- c:\windows\popcinfo.dat
2009-12-20 05:20 . 2009-04-28 04:32 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-06 16:05 . 2009-04-17 05:35 ——– d—–w- c:\program files\Level Up Games
2009-12-06 15:04 . 2009-06-25 19:57 ——– d—–w- c:\program files\Reflexive
2009-12-06 15:04 . 2009-08-07 02:46 ——– d—–w- c:\program files\ToGo Game
2009-12-03 00:19 . 2009-11-01 19:48 25 —-a-w- c:\windows\popcinfot.dat
2009-12-02 16:14 . 2009-04-14 05:23 ——– d—–w- c:\program files\Common Files\LightScribe
2009-11-27 13:34 . 2009-11-27 13:34 8854 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\UNINST_Uninstall_T_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 4286 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Amped_Website.url1_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 4286 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Amped_Website.url_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra_PH_Website._ACB5EAD4CD3E428DBACCD9790AABE3AF_1.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra_PH_Website._ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra.exe1_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra.exe_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\ARPPRODUCTICON.exe
2009-11-27 13:30 . 2009-11-27 13:30 ——– d—–w- c:\program files\AMPED
2009-11-27 04:01 . 2009-11-27 04:01 ——– d—–w- c:\program files\Ask.com
2009-11-27 04:00 . 2009-11-27 04:00 ——– d—–w- c:\program files\BitTorrent
2009-11-08 01:08 . 2009-11-08 01:08 ——– d—–w- c:\program files\GameClub
2009-11-01 20:06 . 2009-11-01 20:06 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-01 18:36 . 2009-11-01 18:36 ——– d—–w- c:\program files\CCleaner
2009-11-01 13:52 . 2009-03-31 01:07 ——– d—–w- c:\program files\Winamp
2009-11-01 08:12 . 2009-11-01 08:12 ——– d—–w- c:\documents and settings\crim\Application Data\Yahoo!
2009-10-27 04:57 . 2009-04-01 06:18 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-10-22 20:02 . 2009-03-31 06:07 98512 —-a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-30 16:31 . 2009-03-30 16:31 16384 –sha-w- c:\windows\keybd.dat
.
c:\program files\Common Files\Nero\Lib\nerocheck .exe
c:\program files\Winamp\winampa .exe

——- Sigcheck ——-

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll
[-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll

[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe
[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe

[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\system32\netman.dll
[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netman.dll

[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll
[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll

[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\system32\rpcss.dll
[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\rpcss.dll

[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\system32\services.exe
[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\services.exe

[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\spoolsv.exe
[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe

[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll
[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll

[-] 2004-08-04 12:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\system32\es.dll
[-] 2004-08-04 12:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\system32\dllcache\es.dll

[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll
[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll

[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\system32\kernel32.dll
[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\kernel32.dll

[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\linkinfo.dll
[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\linkinfo.dll

[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll
[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll

[-] 2009-08-29 . 0E49677EE57A928765FC47FFBACD5326 . 5940224 . . [8.00.6001.18828] . . c:\windows\system32\mshtml.dll
[-] 2009-08-29 . 0E49677EE57A928765FC47FFBACD5326 . 5940224 . . [8.00.6001.18828] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2009-08-29 . B68F6E6C66D17D9EDABF3D5DA71046DA . 5942272 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
[-] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB974455-IE8\mshtml.dll
[-] 2004-08-04 . 376E0843B2356CA91CEC8D9837A56FF7 . 3003392 . . [6.00.2900.2180] . . c:\windows\ie8\mshtml.dll

[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll

[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\system32\mswsock.dll
[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll
[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll

[-] 2004-08-04 . 626309040459C3915997EF98EC1C8D40 . 2148352 . . [5.1.2600.2180] . . c:\windows\system32\ntoskrnl.exe

[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll
[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll

[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll
[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll

[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll
[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll

[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe
[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe

[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\system32\tapisrv.dll
[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tapisrv.dll

[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\system32\user32.dll
[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\user32.dll

[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe
[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe

[-] 2009-08-29 . CF0A5FE05BF614C24950D8FAEC1BC309 . 916480 . . [8.00.6001.18828] . . c:\windows\system32\wininet.dll
[-] 2009-08-29 . CF0A5FE05BF614C24950D8FAEC1BC309 . 916480 . . [8.00.6001.18828] . . c:\windows\system32\dllcache\wininet.dll
[-] 2009-08-29 . 972B226BDAD71C55F3CC9A72BBF8F1C1 . 916480 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[-] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB974455-IE8\wininet.dll
[-] 2004-08-04 . C0823FC5469663BA63E7DB88F9919D70 . 656384 . . [6.00.2900.2180] . . c:\windows\ie8\wininet.dll

[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll
[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll

[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\explorer.exe
[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe

[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll
[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe

[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll
[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll

[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll

[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll

[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe
[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe

[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll

[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll
[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll

[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll
[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll

[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll
[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll

[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll
[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll

[-] 2004-08-04 . 9C3C12975C97119412802B181FBEEFFE . 167936 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll
[-] 2004-08-04 . 9C3C12975C97119412802B181FBEEFFE . 167936 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll

[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2004-08-04 06:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\system32\dllcache\aec.sys
[-] 2004-08-04 06:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\system32\drivers\aec.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\system32\mfc40u.dll
[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\system32\dllcache\mfc40u.dll

[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll
[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll

[-] 2004-08-11 08:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-11 08:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\MsPMSNSv.dll
[-] 2004-08-11 08:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2004-08-04 12:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll

[-] 2004-08-04 . FB142B7007CA2EEA76966C6C5CC12150 . 2015232 . . [5.1.2600.2180] . . c:\windows\system32\ntkrnlpa.exe

[-] 2004-08-04 12:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll
[-] 2004-08-04 12:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll

[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll
[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-07-11 01:28 1174920 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-07-11 1174920]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-07-11 1174920]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-19 4363504]
"TBPanel"="c:\program files\Vtune\TBPanel.exe" [2008-12-19 2158592]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [N/A]
"restor32a"="c:\documents and settings\user\restor32a.exe" [N/A]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-12-17 2002160]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [N/A]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-09 13680640]
"nwiz"="nwiz.exe" [2009-01-09 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-09 86016]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [N/A]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"restor32a"="c:\windows\system32\restor32a.exe" [N/A]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-05 149280]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"globe"="c:\program files\Globe Telecom\Click Fix\bin\sprtcmd.exe" [2009-07-06 204672]

c:\documents and settings\user\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Monitor.lnk - c:\program files\USB Video Camera\Monitor.exe [2007-10-16 249856]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon]
2007-06-28 17:39 65536 —-a-w- c:\windows\system32\LogonDll.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /k:C *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1293:TCP"= 1293:TCP:stuma

R0 DeepFrz;DeepFrz;c:\windows\system32\drivers\DeepFrz.sys [6/28/2007 9:45 AM 131472]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [12/24/2009 8:03 PM 28552]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/20/2008 10:11 AM 33800]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12/16/2009 4:26 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/16/2009 4:26 PM 74480]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12/21/2007 7:21 AM 468224]
R2 sprtsvc_globe;SupportSoft Sprocket Service (globe);c:\program files\Globe Telecom\Click Fix\bin\sprtsvc.exe [12/23/2009 4:10 PM 204672]
R2 tgsrvc_globe;SupportSoft Repair Service (globe);c:\program files\Globe Telecom\Click Fix\bin\tgsrvc.exe [12/23/2009 4:10 PM 151424]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/16/2009 4:27 PM 7408]
S2 ctjjsv;Security Time;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 4:00 AM 14336]
S2 dnipfw;Helper Universal;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 4:00 AM 14336]
S2 lqqveejfh;Manager Universal;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 4:00 AM 14336]
S3 AghAsh;AghAsh;\??\c:\documents and settings\user\Desktop\AghAsh.des –> c:\documents and settings\user\Desktop\AghAsh.des [?]
S3 AghHip;AghHip;\??\c:\documents and settings\user\Desktop\AghHip.des –> c:\documents and settings\user\Desktop\AghHip.des [?]
S3 Ca2001v;CA2001 WebCam Driver;c:\windows\system32\drivers\Ca2001v.sys [2/19/2008 10:48 AM 2333568]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 XDva288;XDva288;\??\c:\windows\system32\XDva288.sys –> c:\windows\system32\XDva288.sys [?]
S3 XDva300;XDva300;\??\c:\windows\system32\XDva300.sys –> c:\windows\system32\XDva300.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
lqqveejfh
dnipfw
ctjjsv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {D84EB4B0-BFA9-4B0C-B75A-17ABAD45ABB7} - hxxp://images.friendster.com/200911A-072/js/aurigma/FriendsterImageUploader.cab
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\dybn5c8q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=BT3&o=14979&locale=en_US&q=
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Rohan_RBF - c:\program files\Level Up Games\Rohan Giants\GoUninstRBF.exe
AddRemove-Visual Studio 6.0 Enterprise Edition - c:\program files\Microsoft Visual Studio\Common\Setup\1033\Setup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-29 08:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A566E07]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecfc3
\Driver\ACPI -> ACPI.sys @ 0xb9f7fcb8
\Driver\atapi -> atapi.sys @ 0xb9f117b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
NDIS: NVIDIA nForce 10/100 Mbps Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9de2ba0
PacketIndicateHandler -> NDIS.sys @ 0xb9defb21
SendHandler -> NDIS.sys @ 0xb9dcd87b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\AghAsh]
"ImagePath"="\??\c:\documents and settings\user\Desktop\AghAsh.des"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\AghHip]
"ImagePath"="\??\c:\documents and settings\user\Desktop\AghHip.des"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ctjjsv]
"ServiceDll"="c:\windows\system32\mkqkc.dll"
–

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\dnipfw]
"ServiceDll"="c:\program files\Movie Maker\mkqkc.dll"
–

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\lqqveejfh]
"ServiceDll"="c:\windows\system32\mkqkc.dll"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\LogonDll.dll

- - - - - - - > 'lsass.exe'(760)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3048)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\windows\system32\mdm.exe
.
**************************************************************************
.
Completion time: 2009-12-29 08:53:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-29 16:53

Pre-Run: 17,338,884,096 bytes free
Post-Run: 19,725,598,720 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 7888749D06E8E0337CD89E2631BBBC7D


HighjackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:03:15 AM, on 12/29/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Globe Telecom\Click Fix\bin\sprtsvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Globe Telecom\Click Fix\bin\sprtcmd.exe
C:\Program Files\Vtune\TBPanel.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\USB Video Camera\Monitor.exe
C:\Program Files\Globe Telecom\Click Fix\bin\tgsrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [restor32a] C:\WINDOWS\system32\restor32a.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [globe] C:\Program Files\Globe Telecom\Click Fix\bin\sprtcmd.exe /P globe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [TBPanel] C:\Program Files\Vtune\TBPanel.exe /A
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [restor32a] C:\Documents and Settings\user\restor32a.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Monitor.lnk = C:\Program Files\USB Video Camera\Monitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1257100376578
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {D84EB4B0-BFA9-4B0C-B75A-17ABAD45ABB7} (Friendster Image Uploader Control) - http://images.friendster.com/200911A-072/j…ageUploader.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: SupportSoft Sprocket Service (globe) (sprtsvc_globe) - SupportSoft, Inc. - C:\Program Files\Globe Telecom\Click Fix\bin\sprtsvc.exe
O23 - Service: SupportSoft Repair Service (globe) (tgsrvc_globe) - SupportSoft, Inc. - C:\Program Files\Globe Telecom\Click Fix\bin\tgsrvc.exe
O23 - Service: Visual Studio Analyzer RPC bridge - Unknown owner - C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe (file missing)

–
End of file - 9873 bytes

as of know im monitoring my PC performance
Post #4
We still have some infections.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
atapi.sys
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #5
"Happy New Year" Here's the log SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 09:09 on 01/01/2010 by user (Administrator - Elevation successful) ========== filefind ========== Searching for "atapi.sys" C:\WINDOWS\system32\drivers\atapi.sys —— 95360 bytes [12:00 04/08/2004] [12:00 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51 C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys –a— 95360 bytes [00:52 31/03/2009] [12:00 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51 -=End Of File=- ……………………………… just want to ask what kind of infection do i have? thank you..
Post #6
Well we know you have atleast a Rootkit and a trojan C:\WINDOWS\system32\Drivers\str.sys (Rootkit.Agent) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\synsend (Trojan.Agent) You have legit files that have been replaced by infected files. Do you have your windows CD?
Post #7
You need to reinstall Nero and Winamp


Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
c:\documents and settings\user\restor32a.exe
c:\windows\system32\mkqkc.dll

Folder::
c:\program files\Ask.com
c:\program files\Common Files\Nero
c:\program files\Winamp

Driver::
lqqveejfh
dnipfw
ctjjsv

NetSvc::
lqqveejfh
dnipfw
ctjjsv

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"restor32a"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"restor32a"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ctjjsv]
[-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\dnipfw]
[-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\lqqveejfh]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #8
1st of all a txtfile just show up and i dont think its part of what ive done……

File "C:\ComboFix\MT_atapi.sys.tmp" added successfully



i dont know what that log was but it has a caption "Catchmeup"

……………………………………………………………..

here's the log

ComboFix 10-01-04.01 - user 01/06/2010 23:31:47.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1694 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\user\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active


FILE ::
"c:\documents and settings\user\restor32a.exe"
"c:\windows\system32\mkqkc.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe
c:\program files\Common Files\Nero
c:\program files\Common Files\Nero\AudioPlugins\AC3.dll
c:\program files\Common Files\Nero\AudioPlugins\Aiff.dll
c:\program files\Common Files\Nero\AudioPlugins\AReadyLB_Nero.dll
c:\program files\Common Files\Nero\AudioPlugins\Audible.dll
c:\program files\Common Files\Nero\AudioPlugins\DefConvertor.dll
c:\program files\Common Files\Nero\AudioPlugins\lame_enc.dll
c:\program files\Common Files\Nero\AudioPlugins\Mgr\AudioPluginMgr.dll
c:\program files\Common Files\Nero\AudioPlugins\mp3PP.dll
c:\program files\Common Files\Nero\AudioPlugins\mp3PRO.dll
c:\program files\Common Files\Nero\AudioPlugins\msa.dll
c:\program files\Common Files\Nero\AudioPlugins\MSAxp.dll
c:\program files\Common Files\Nero\AudioPlugins\NeroDigital.dll
c:\program files\Common Files\Nero\AudioPlugins\NeroStarter.dll
c:\program files\Common Files\Nero\AudioPlugins\ogg.dll
c:\program files\Common Files\Nero\AudioPlugins\Wav.dll
c:\program files\Common Files\Nero\BackItUp\BackItUp.ico
c:\program files\Common Files\Nero\DSFilter\AReadyLB_Nero.dll
c:\program files\Common Files\Nero\DSFilter\DTSTranscode1m5DL.dll
c:\program files\Common Files\Nero\DSFilter\NeAudCD.ax
c:\program files\Common Files\Nero\DSFilter\NeAudible.ax
c:\program files\Common Files\Nero\DSFilter\NeAudio2.ax
c:\program files\Common Files\Nero\DSFilter\NeAudioRender.ax
c:\program files\Common Files\Nero\DSFilter\NeAVSync.ax
c:\program files\Common Files\Nero\DSFilter\NeBDGraphic.ax
c:\program files\Common Files\Nero\DSFilter\NeBDThumbnail.ax
c:\program files\Common Files\Nero\DSFilter\NeCapture.ax
c:\program files\Common Files\Nero\DSFilter\NeColorspace.ax
c:\program files\Common Files\Nero\DSFilter\NeDeinterlace.ax
c:\program files\Common Files\Nero\DSFilter\NeDiscManager.dll
c:\program files\Common Files\Nero\DSFilter\NeDtsDec.dll
c:\program files\Common Files\Nero\DSFilter\NeDVD.ax
c:\program files\Common Files\Nero\DSFilter\NeDVSplitter.ax
c:\program files\Common Files\Nero\DSFilter\NeESParser.ax
c:\program files\Common Files\Nero\DSFilter\NeFileSourceAsync.ax
c:\program files\Common Files\Nero\DSFilter\NeFLVSplitter.ax
c:\program files\Common Files\Nero\DSFilter\NeFramerate.ax
c:\program files\Common Files\Nero\DSFilter\NeHDAudioMixer.ax
c:\program files\Common Files\Nero\DSFilter\NeHttpManager.dll
c:\program files\Common Files\Nero\DSFilter\NeMP2AudioEnc.ax
c:\program files\Common Files\Nero\DSFilter\NeMp3Encoder.ax
c:\program files\Common Files\Nero\DSFilter\NeMP4Splitter.ax
c:\program files\Common Files\Nero\DSFilter\NeMpegVideoEnc.ax
c:\program files\Common Files\Nero\DSFilter\NeNDAud.ax
c:\program files\Common Files\Nero\DSFilter\NeNDGui.dll
c:\program files\Common Files\Nero\DSFilter\NeNDMux.ax
c:\program files\Common Files\Nero\DSFilter\NeNDVid.ax
c:\program files\Common Files\Nero\DSFilter\NeOggSplitter.ax
c:\program files\Common Files\Nero\DSFilter\NePhotoSource.ax
c:\program files\Common Files\Nero\DSFilter\NePSMuxer.ax
c:\program files\Common Files\Nero\DSFilter\NeQTDec.ax
c:\program files\Common Files\Nero\DSFilter\NeResize.ax
c:\program files\Common Files\Nero\DSFilter\NeroVideoProc.ax
c:\program files\Common Files\Nero\DSFilter\NeroVobuGenerator.ax
c:\program files\Common Files\Nero\DSFilter\NeSBE.ax
c:\program files\Common Files\Nero\DSFilter\NeSceneDetector.ax
c:\program files\Common Files\Nero\DSFilter\NeSoundProc.ax
c:\program files\Common Files\Nero\DSFilter\NeSoundSwitch.ax
c:\program files\Common Files\Nero\DSFilter\NeSplitter.ax
c:\program files\Common Files\Nero\DSFilter\NeSubpicture.ax
c:\program files\Common Files\Nero\DSFilter\NeSubtitle.ax
c:\program files\Common Files\Nero\DSFilter\NeTeletext.ax
c:\program files\Common Files\Nero\DSFilter\NeTranscoder.ax
c:\program files\Common Files\Nero\DSFilter\NeTSMuxer.ax
c:\program files\Common Files\Nero\DSFilter\NeVCD.ax
c:\program files\Common Files\Nero\DSFilter\NeVCR.ax
c:\program files\Common Files\Nero\DSFilter\NeVideo.ax
c:\program files\Common Files\Nero\DSFilter\NeVideoAnalyzer.ax
c:\program files\Common Files\Nero\DSFilter\NeVideoHD.ax
c:\program files\Common Files\Nero\DSFilter\NeVideoRenderer.ax
c:\program files\Common Files\Nero\DSFilter\NeVP6Dec.dll
c:\program files\Common Files\Nero\InCDReader\InCDReader.ico
c:\program files\Common Files\Nero\Lib\BCGCBPRO860u80.dll
c:\program files\Common Files\Nero\Lib\BCGPOleAcc.dll
c:\program files\Common Files\Nero\Lib\DriveLocker.dll
c:\program files\Common Files\Nero\Lib\em2v.dll
c:\program files\Common Files\Nero\Lib\log4cxx.dll
c:\program files\Common Files\Nero\Lib\MediaLibraryNSE.dll
c:\program files\Common Files\Nero\Lib\MultiChannel.dll
c:\program files\Common Files\Nero\Lib\ndaudio.dll
c:\program files\Common Files\Nero\Lib\NeEm2a.dll
c:\program files\Common Files\Nero\Lib\NeEm2v.dll
c:\program files\Common Files\Nero\Lib\NeroAPIGlueLayerMultiByte.dll
c:\program files\Common Files\Nero\Lib\NeroAPIGlueLayerUnicode.dll
c:\program files\Common Files\Nero\Lib\NeroCBUI.dll
c:\program files\Common Files\Nero\Lib\nerocheck .exe
c:\program files\Common Files\Nero\Lib\NeroCmd.exe
c:\program files\Common Files\Nero\Lib\NeroCOM.dll
c:\program files\Common Files\Nero\Lib\NeroDigitalExt.dll
c:\program files\Common Files\Nero\Lib\NeroFileDialog.dll
c:\program files\Common Files\Nero\Lib\NeroFileDialogCF.dll
c:\program files\Common Files\Nero\Lib\NeroFileDialogIDLPS.dll
c:\program files\Common Files\Nero\Lib\NeroFileDialogVista.dll
c:\program files\Common Files\Nero\Lib\NeroIPP.dll
c:\program files\Common Files\Nero\Lib\NeroPreview.dll
c:\program files\Common Files\Nero\Lib\NeroPreview\default\background.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\nero_logo.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\pause hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\pause pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\pause.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\play hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\play pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\play.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\skin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\skin.xml
c:\program files\Common Files\Nero\Lib\NeroPreview\default\slider button hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\slider button pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\slider button.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\slider.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\slider_bkgnd.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\slider_fill.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\sound_toggle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\sound_toggle_hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\sound_toggle_pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\stop hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\stop pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\default\stop.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\pause hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\pause pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\pause.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\play hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\play pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\play.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\skin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\skin.xml
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\skinalt.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\slider button hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\slider button pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\slider button.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\slider.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\slider_bkgnd.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\slider_fill.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\stop hot.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\stop pushed.png
c:\program files\Common Files\Nero\Lib\NeroPreview\filedlg\stop.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich.xml
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\background.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\browse.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\browseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\browseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\changeskin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\changeskinH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\changeskinP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\controls_middlemiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\knob.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\knobH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\knobP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\nero_logo.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\nerodigital.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\next.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\nextH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\nextP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\pause.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\pauseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\pauseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\play.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_bottomleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_bottommiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_bottomright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_middleleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_middlemiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_middleright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_topleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_topmiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\player_topright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\playH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\playP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\previous.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\previousH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\previousP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\separator.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\skin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\skin.xml
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\slider_empty.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\slider_full.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\sndoff.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\sndoffH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\sndoffP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\sndon.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\sndonH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\sndonP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\stop.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\stopH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\stopP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\wallpaper.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\wallpaperH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\black\wallpaperP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\background.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\browse.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\browseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\browseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\changeskin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\changeskinH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\changeskinP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\controls_middlemiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\knob.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\knobH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\knobP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\nero_logo.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\nerodigital.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\next.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\nextH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\nextP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\pause.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\pauseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\pauseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\play.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_bottom.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_bottomleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_bottommiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_bottomright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_middleleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_middlemiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_middleright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_top.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_topleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_topmiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_topright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\player_video.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\playH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\playP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\previous.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\previousH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\previousP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\separator.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\skin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\skin.xml
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\slider_empty.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\slider_full.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\sndoff.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\sndoffH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\sndoffP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\sndon.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\sndonH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\sndonP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\stop.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\stopH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\stopP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\wallpaper.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\wallpaperH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\green\wallpaperP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\background.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\browse.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\browseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\browseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\changeskin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\changeskinH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\changeskinP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\knob.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\knobH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\knobP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\nero_logo.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\nerodigital.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\next.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\nextH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\nextP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\pause.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\pauseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\pauseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\play.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_bottomleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_bottommiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_bottomright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_middleleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_middlemiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_middleright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_topleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_topmiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\player_topright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\playH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\playP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\previous.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\previousH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\previousP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\separator.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\skin.xml
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\slider_empty.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\slider_full.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\sndoff.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\sndoffH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\sndoffP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\sndon.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\sndonH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\sndonP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\stop.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\stopH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\stopP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\wallpaper.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\wallpaperH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\red\wallpaperP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\background.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\browse.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\browseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\browseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\changeskin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\changeskinH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\changeskinP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\controls_middlemiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\knob.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\knobH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\knobP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\nero_logo.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\nerodigital.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\next.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\nextH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\nextP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\pause.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\pauseH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\pauseP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\play.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_bottomleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_bottommiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_bottomright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_middleleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_middlemiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_middleright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_topleft.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_topmiddle.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\player_topright.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\playH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\playP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\previous.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\previousH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\previousP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\separator.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\skin.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\skin.xml
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\slider_empty.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\slider_full.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\sndoff.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\sndoffH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\sndoffP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\sndon.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\sndonH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\sndonP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\stop.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\stopH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\stopP.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\wallpaper.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\wallpaperH.png
c:\program files\Common Files\Nero\Lib\NeroPreview\rich\white\wallpaperP.png
c:\program files\Common Files\Nero\Lib\NeroScout_Eng.chm
c:\program files\Common Files\Nero\Lib\NeroScoutOptions.exe
c:\program files\Common Files\Nero\Lib\NeroSearch.dll
c:\program files\Common Files\Nero\Lib\NeroSearchAdvanced.exe
c:\program files\Common Files\Nero\Lib\NeroSearchBar.dll
c:\program files\Common Files\Nero\Lib\NeroSearchTray.dll
c:\program files\Common Files\Nero\Lib\NeroSearchTrayHook.dll
c:\program files\Common Files\Nero\Lib\NeroVMRModules.dll
c:\program files\Common Files\Nero\Lib\NeVcr.dll
c:\program files\Common Files\Nero\Lib\NMAudioCDContentHandler.dll
c:\program files\Common Files\Nero\Lib\NMBC.dll
c:\program files\Common Files\Nero\Lib\NMBCInterfacePS.dll
c:\program files\Common Files\Nero\Lib\NMBCWriter.dll
c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe
c:\program files\Common Files\Nero\Lib\NMCdRip.dll
c:\program files\Common Files\Nero\Lib\NMCoFoundation.dll
c:\program files\Common Files\Nero\Lib\NMCoreA.dll
c:\program files\Common Files\Nero\Lib\NMCoreB.dll
c:\program files\Common Files\Nero\Lib\NMCoreC.dll
c:\program files\Common Files\Nero\Lib\NMCoreD.dll
c:\program files\Common Files\Nero\Lib\NMCoreE.dll
c:\program files\Common Files\Nero\Lib\NMDataServices.dll
c:\program files\Common Files\Nero\Lib\NMDataServicesA.dll
c:\program files\Common Files\Nero\Lib\NMDataServicesB.dll
c:\program files\Common Files\Nero\Lib\NMDataServicesC.dll
c:\program files\Common Files\Nero\Lib\NMDataServicesD.dll
c:\program files\Common Files\Nero\Lib\NMDataServicesE.dll
c:\program files\Common Files\Nero\Lib\NMDefaultDRMDialogs.dll
c:\program files\Common Files\Nero\Lib\NMDllHost.exe
c:\program files\Common Files\Nero\Lib\NMDvdContentHandler.dll
c:\program files\Common Files\Nero\Lib\NMFileContentHandler.dll
c:\program files\Common Files\Nero\Lib\NMFirstStart.exe
c:\program files\Common Files\Nero\Lib\NMFullTextExtraction.dll
c:\program files\Common Files\Nero\Lib\NMHDirServices.dll
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Common Files\Nero\Lib\NMIndexingServicePS.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreA.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreB.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreC.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreD.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreE.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreF.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreG.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreH.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreI.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreJ.dll
c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
c:\program files\Common Files\Nero\Lib\NMIndexStoreSvrPS.dll
c:\program files\Common Files\Nero\Lib\NMiTunesIntegration.dll
c:\program files\Common Files\Nero\Lib\NMLogCxx.dll
c:\program files\Common Files\Nero\Lib\NMPFContentHandler.dll
c:\program files\Common Files\Nero\Lib\NMPlaybackComponent.dll
c:\program files\Common Files\Nero\Lib\NMPluginBase.cfg
c:\program files\Common Files\Nero\Lib\NMPluginBase.dll
c:\program files\Common Files\Nero\Lib\NMScriptingObject.dll
c:\program files\Common Files\Nero\Lib\NMSearch.dll
c:\program files\Common Files\Nero\Lib\NMSearchA.dll
c:\program files\Common Files\Nero\Lib\NMSearchB.dll
c:\program files\Common Files\Nero\Lib\NMSearchC.dll
c:\program files\Common Files\Nero\Lib\NMSearchD.dll
c:\program files\Common Files\Nero\Lib\NMSearchE.dll
c:\program files\Common Files\Nero\Lib\NMSearchPluginMediaLibrary.dll
c:\program files\Common Files\Nero\Lib\NMSearchPluginSimilarImages.dll
c:\program files\Common Files\Nero\Lib\NMSearchPluginWeb.dll
c:\program files\Common Files\Nero\Lib\NMSlideShow.dll
c:\program files\Common Files\Nero\Lib\NMSQLDB.dll
c:\program files\Common Files\Nero\Lib\NMSSContentHandler.dll
c:\program files\Common Files\Nero\Lib\NMSSEffects.dll
c:\program files\Common Files\Nero\Lib\NMSVCDContentHandler.dll
c:\program files\Common Files\Nero\Lib\NMThumbnailIconsGen.dll
c:\program files\Common Files\Nero\Lib\NMTTranscoder.dll
c:\program files\Common Files\Nero\Lib\NMTVEpgPluginXmlTv.dll
c:\program files\Common Files\Nero\Lib\NMTVRecorder.exe
c:\program files\Common Files\Nero\Lib\NMTVServer.dll
c:\program files\Common Files\Nero\Lib\NMTVServices.dll
c:\program files\Common Files\Nero\Lib\NMTVStreamContentHandler.dll
c:\program files\Common Files\Nero\Lib\NMTvWizard.exe
c:\program files\Common Files\Nero\Lib\NMUIEngine.dll
c:\program files\Common Files\Nero\Lib\NMUIGDIPlus.dll
c:\program files\Common Files\Nero\Lib\NMUIStreaming.dll
c:\program files\Common Files\Nero\Lib\NMUIVKStandard.dll
c:\program files\Common Files\Nero\Lib\NMUPnPBrowser.dll
c:\program files\Common Files\Nero\Lib\NMUPnPServices.dll
c:\program files\Common Files\Nero\Lib\NMUPnPServicesLibPS.dll
c:\program files\Common Files\Nero\Lib\NMVisualizerNas.dll
c:\program files\Common Files\Nero\Lib\uNeroMediaCon.dll
c:\program files\Common Files\Nero\NAS\nas\fx1.nvl
c:\program files\Common Files\Nero\NAS\nas\languages.nvl
c:\program files\Common Files\Nero\NAS\nas\NasEditor.nvl
c:\program files\Common Files\Nero\NAS\nas\presets\Afterglow.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Alien Funk Too.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Alien Funk.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Black Hole.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Blobz.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Bouncing Betty.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Chaos.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Circumvent.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\ColorSpray.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Crunch.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Dances with sprites.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Dancing Flower.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Deep Dive.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Drunk.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Evil Germz.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Explosion.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Flash.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Floor.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Fuzzy.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Groovy Plasma.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Hotlines.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Hypnotic.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Ieltjes Carnaval.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Ieltjes Thing 2.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Ieltjes Thing.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\In and Out.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Inside.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Insufficient Dictionary.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Into the Deep.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Jelly Wormz.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Kaleidoscope.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Landscape.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Line Art.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Liquid.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Mars.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Microscope.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\MindTwizt.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\MJ Past and Present.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Need Sunglassez.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\New Preset.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Nice.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Owww.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Paddo Tango.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Pentium.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Perspective Tunnel.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Planar.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Plant.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Plasma.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Plumeau.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\PsychoZoom.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Quantum Tunnel.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\RenderExample1.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\RenderExample2.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\RenderExample3.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Ring.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Shadows.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Shining Star.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Shortcut.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Slime.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Smudge.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Spacy.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\SpiderRag.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Spin Art.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Spring.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\SpriteScope.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Spyrodelic.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Squares.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Stairways.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Starfield.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Symmetry to the point.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\The Black Lotus.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Torus.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Tri-act.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Tubes.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Tunnel.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Unlimited Objects.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Vaagheid Galore.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Waterfall.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\WaterMorph.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Wormhole.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Xyber.nvp
c:\program files\Common Files\Nero\NAS\nas\presets\Zoomer.nvp
c:\program files\Common Files\Nero\NAS\vis_nas.dll
c:\program files\Common Files\Nero\Nero Web\APATCH.DLL
c:\program files\Common Files\Nero\Nero Web\NeroControlCenter_Eng.chm
c:\program files\Common Files\Nero\Nero Web\nps.dll
c:\program files\Common Files\Nero\Nero Web\SetupX.exe
c:\program files\Common Files\Nero\Nero Web\unrar.dll
c:\program files\Common Files\Nero\Nero8\Burning ROM.ico
c:\program files\Common Files\Nero\Nero8\Eula\EULA_chs.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_cht.rtf
c:\program files\Common Files\Nero\Nero8\Eula\Eula_deu.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_ene.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_eng.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_esp.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_fra.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_ita.rtf
c:\program files\Common Files\Nero\Nero8\Eula\Eula_jpn.rtf
c:\program files\Common Files\Nero\Nero8\Eula\Eula_kor.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_nld.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_ptg.rtf
c:\program files\Common Files\Nero\Nero8\Eula\EULA_sve.rtf
c:\program files\Common Files\Nero\NeroBLC\BDEngine.dll
c:\program files\Common Files\Nero\NeroBLC\HDDVDEngine.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\GCHW.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\NeroCaptureAPI.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\NMTVConfigdvbc.xml
c:\program files\Common Files\Nero\NeroCaptureAPI\NMTVConfigdvbs.xml
c:\program files\Common Files\Nero\NeroCaptureAPI\NMTVConfigdvbt.xml
c:\program files\Common Files\Nero\NeroCaptureAPI\plugins\AnalogTvPlugin.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\plugins\CreatixDevicePlugin.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\plugins\DigitalTvPlugin.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\plugins\HauppaugeDevicePlugin.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\plugins\TechnoTrendDevicePlugin.dll
c:\program files\Common Files\Nero\NeroCaptureAPI\plugins\TerratecDevicePlugin.dll
c:\program files\Common Files\Nero\NeroDigital\NeroDigital.dll
c:\program files\Common Files\Nero\NeroDigital\NeroDigital.ocx
c:\program files\Common Files\Nero\NeroDigital\plug-ins\NDColorDMO.dll
c:\program files\Common Files\Nero\NeroDigital\plug-ins\NDDenoiseDMO.dll
c:\program files\Common Files\Nero\NeroMediaSearch\BCGCBPRO860u80.dll
c:\program files\Common Files\Nero\NeroSlideShow\gdiplus.DLL
c:\program files\Common Files\Nero\NeroSlideShow\SlideShw.exe
c:\program files\Common Files\Nero\NTP\Nero 8\1033.mst
c:\program files\Common Files\Nero\NTP\Nero 8\mst.txt
c:\program files\Common Files\Nero\RemoteControl\NeroAti.dl_
c:\program files\Common Files\Nero\RemoteControl\NeroAti.dll
c:\program files\Common Files\Nero\RemoteControl\NeroRcPluginAti.dll
c:\program files\Common Files\Nero\RemoteControl\NeroRcPluginHauppauge.dll
c:\program files\Common Files\Nero\RemoteControl\NeroRcPluginMCE.dll
c:\program files\Common Files\Nero\RemoteControl\NeroRemoteControlHandler.cfg
c:\program files\Common Files\Nero\RemoteControl\NeroRemoteCtrlHandler.dll
c:\program files\Common Files\Nero\RemoteControl\NeroRemoteCtrlInterfaces.dll
c:\program files\Common Files\Nero\SecurDisc Viewer\SDViewer.ico
c:\program files\Common Files\Nero\Shared\NL3\AdvrCntr3.dll
c:\program files\Common Files\Nero\Shared\NL3\btc-bar.gif
c:\program files\Common Files\Nero\Shared\NL3\logo.gif
c:\program files\Common Files\Nero\Shared\NL3\NeroAPIGlueLayerUnicode.dll
c:\program files\Common Files\Nero\Shared\NL3\NEROINST.DB
c:\program files\Common Files\Nero\Shared\NL3\NeroPatentActivation.exe
c:\program files\Common Files\Nero\Shared\NL3\NeroUpgrade.exe
c:\program files\Common Files\Nero\Shared\NL3\patentactivationfax.htm
c:\program files\Common Files\Nero\Shared\NL3\rollback.db
c:\program files\Common Files\Nero\Shared\NL3\ShellManager3.dll
c:\program files\Common Files\Nero\Shared\NSCLoader.dll
c:\program files\Winamp
c:\program files\Winamp\burnlib.dll
c:\program files\Winamp\demo.mp3
c:\program files\Winamp\install.ini
c:\program files\Winamp\libmp4v2.dll
c:\program files\Winamp\libsndfile.dll
c:\program files\Winamp\nde.dll
c:\program files\Winamp\nscrt.dll
c:\program files\Winamp\pconfig.dcf
c:\program files\Winamp\Plugins\avs\AddBorder.ape
c:\program files\Winamp\Plugins\avs\avsres_texer_circle_edgeonly_19x19.bmp
c:\program files\Winamp\Plugins\avs\avsres_texer_circle_edgeonly_29x29.bmp
c:\program files\Winamp\Plugins\avs\avsres_texer_circle_heavyblur_19x19.bmp
c:\program files\Winamp\Plugins\avs\avsres_texer_circle_heavyblur_21x21.bmp
c:\program files\Winamp\Plugins\avs\avsres_texer_circle_sharp_19x19.bmp
c:\program files\Winamp\Plugins\avs\colormap.ape
c:\program files\Winamp\Plugins\avs\Community Picks\Acid - Twitchy liquid stuff (mixing plastics mix by tuggummi).avs
c:\program files\Winamp\Plugins\avs\Community Picks\amphirion - Ex Deux Mechanica.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Amphirion - Geometric Sustinance.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Degnic - Data flow.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Degnic - Fractal (slo-mo metallic) (u).avs
c:\program files\Winamp\Plugins\avs\Community Picks\Degnic - Fury (extreme remix) by fsk.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Degnic - Helium.avs
c:\program files\Winamp\Plugins\avs\Community Picks\degnic - spirit realm (plasmoid rmx).avs
c:\program files\Winamp\Plugins\avs\Community Picks\duo - alien intercourse 4.avs
c:\program files\Winamp\Plugins\avs\Community Picks\duo - Alienated (evilrice trinity tron remix).avs
c:\program files\Winamp\Plugins\avs\Community Picks\Duo - Hash the Planet.avs
c:\program files\Winamp\Plugins\avs\Community Picks\duo - warm freeform.avs
c:\program files\Winamp\Plugins\avs\Community Picks\el-vis - golden.avs
c:\program files\Winamp\Plugins\avs\Community Picks\el-vis - hubble002.avs
c:\program files\Winamp\Plugins\avs\Community Picks\el-vis - rittaufdemfeuerstrahl.avs
c:\program files\Winamp\Plugins\avs\Community Picks\el-vis - spindle.avs
c:\program files\Winamp\Plugins\avs\Community Picks\fUk - afterburner remix.avs
c:\program files\Winamp\Plugins\avs\Community Picks\fUk - cube.avs
c:\program files\Winamp\Plugins\avs\Community Picks\fUk - ice cube.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Jay-Fatboy - Pieces of a Dead world.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Jheriko - Alien Device (Gallery Remix by Zamuz).avs
c:\program files\Winamp\Plugins\avs\Community Picks\NemoOrange - Building Blocks.avs
c:\program files\Winamp\Plugins\avs\Community Picks\NemoOrange - Clockwork.avs
c:\program files\Winamp\Plugins\avs\Community Picks\NemoOrange - the Light of Speed.avs
c:\program files\Winamp\Plugins\avs\Community Picks\NemoOrange vs el-vis - dreamtime2.avs
c:\program files\Winamp\Plugins\avs\Community Picks\S_KuPeRS - Curvism 002 (Tuggummi's Paprika Mix).avs
c:\program files\Winamp\Plugins\avs\Community Picks\s_kupers - gace.avs
c:\program files\Winamp\Plugins\avs\Community Picks\s_kupers - the revenge of mt. doom.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Shock Value - Architectural Design (v.1.01).avs
c:\program files\Winamp\Plugins\avs\Community Picks\shock value - source of power.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Tonic - One More (BW Contest).avs
c:\program files\Winamp\Plugins\avs\Community Picks\Tonic - Zoomed Picture from One Insect.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Tuggummi - Let me out!.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Tuggummi - Shiny metal curves.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Butterfly Caught.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Daedalus.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Don't Trip and Drive.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Goldie.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Mister Santa.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Seismogrid.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Silk Strings.avs
c:\program files\Winamp\Plugins\avs\Community Picks\UnConeD - Tokyo Bullet.avs
c:\program files\Winamp\Plugins\avs\Community Picks\yathosho - interlaced.avs
c:\program files\Winamp\Plugins\avs\Community Picks\yathosho - sakura.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Yathosho - SKOGSKLOCKA™.avs
c:\program files\Winamp\Plugins\avs\Community Picks\zamuz - big bang.avs
c:\program files\Winamp\Plugins\avs\Community Picks\Zamuz - Explosive Virus.avs
c:\program files\Winamp\Plugins\avs\Community Picks\zamuz - spiritual.avs
c:\program files\Winamp\Plugins\avs\Community Picks\zamuz meets tuggummi - fat balls (wallpaper wannabe candy theme).avs
c:\program files\Winamp\Plugins\avs\Community Picks\Zevensoft - Ocean4.avs
c:\program files\Winamp\Plugins\avs\convolution.ape
c:\program files\Winamp\Plugins\avs\flow3.0-5.bmp
c:\program files\Winamp\Plugins\avs\fyrewurx.ape
c:\program files\Winamp\Plugins\avs\multifilter.ape
c:\program files\Winamp\Plugins\avs\skupers_lp6_02.bmp
c:\program files\Winamp\Plugins\avs\skupers_lp7_01.bmp
c:\program files\Winamp\Plugins\avs\sv_architectimage_256.bmp
c:\program files\Winamp\Plugins\avs\sv_architectimage_buffer.bmp
c:\program files\Winamp\Plugins\avs\sv_texer_simplefade.bmp
c:\program files\Winamp\Plugins\avs\texer.ape
c:\program files\Winamp\Plugins\avs\texer2.ape
c:\program files\Winamp\Plugins\avs\tug_3dpack_texer4.bmp
c:\program files\Winamp\Plugins\avs\tug_bit2_texer5.bmp
c:\program files\Winamp\Plugins\avs\tug_ti_texer2.bmp
c:\program files\Winamp\Plugins\avs\whacko6-06.bmp
c:\program files\Winamp\Plugins\avs\whacko6-07.bmp
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\amphirion - nebulous (skupers remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\D&L; - Life Is Violated.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Degnic-Adrealine rush.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Degnic - Retrowall (Yathosho's Supermicrocosm).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Duo - Alien Heart.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Duo - Brainstorm.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\EL-VIS - Molecules (S_KuPeRS Remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\el-vis - soundscape III (skupers remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\fck - checkers with metaballs (skupers remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\horse-fly - jinx (skupers remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\jheriko - not quite a bendy tunnel (skupers remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\justin - newpoop (for wa5).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\justin - the landscape is killing me (wa5remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\L1quid - Take the Veil.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Dragonscales.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Encapsulade.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Freekwyrms.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Lilypod.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Mist Wisps.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Nebulating - Hypercolorspace.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Reverb - Deep Net.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Slyde - Tri.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Solar Flaire.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Spintronics - Backspin.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Starslappin.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Street Art - Fire Inside.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\mig - Swoo - Slow.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Nic01 - Rototronik.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\nixa - smell of music (skupers remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\p-k - bumpy.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - …hidden track….avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - A Tribute To Degnic.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Arctic Rainbow.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Chinook.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - female demands.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Hexual Healing.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Inverse Kinetics.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Kingish.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Spirit Realm (Degnic's Plasmoid RMX).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Texering 002.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Upward Current.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\skupers - chinook (exclusive version).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\splendora.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Aqua-fumes.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Club Seizure (color enhanced mix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Different Load.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Electro blobs.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Kaleidofied.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Magma Flow II.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Multiple Orgasms.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Odour Control.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Pina Colada.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Scope in Spotlight II.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Solero Shots.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Square Minded.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Worm-O-Rama (Raz Remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Zero-G Maze.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Cartoon Trip.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Containment.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Cubic Flower.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Jello Cube.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Mercury.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Neon Coaster.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Plankton.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Reflectocube.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Speeder 3K.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - TC Plasma.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Tie Tunnel SSC.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD - Zero-G Maze II.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD -Retrosquares.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\UnConeD -Zero-G Maze III.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\yathosho - fabric (skupers remix).avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\Yathosho - microcosm 02.avs
c:\program files\Winamp\Plugins\avs\Winamp 5 Picks\zxe-Urantia.avs
c:\program files\Winamp\Plugins\CDDBControlWinamp.dll
c:\program files\Winamp\Plugins\CDDBUIWinamp.dll
c:\program files\Winamp\Plugins\dsp_sps.dll
c:\program files\Winamp\Plugins\DSP_SPS\cockos - octave down.sps
c:\program files\Winamp\Plugins\DSP_SPS\cockos - octave up.sps
c:\program files\Winamp\Plugins\DSP_SPS\cockos - pitch down.sps
c:\program files\Winamp\Plugins\DSP_SPS\cockos - variable length delay.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - delay (with feedback).sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - huge massive speederupper.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - loop sampler.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - low res delay.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - mix to mono.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - resolution reduction.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - reverseness.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - simple delay.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - simple pitch and tempo (half-2x) control.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - simple volume control.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - stereo channel swap.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - stupid stereo voice removal.sps
c:\program files\Winamp\Plugins\DSP_SPS\justin - tremolo and pingpong.sps
c:\program files\Winamp\Plugins\enc_aacplus.dll
c:\program files\Winamp\Plugins\enc_flac.dll
c:\program files\Winamp\Plugins\enc_lame.dll
c:\program files\Winamp\Plugins\enc_wma.dll
c:\program files\Winamp\Plugins\freeform\xml\about\about.maki
c:\program files\Winamp\Plugins\freeform\xml\about\about.xml
c:\program files\Winamp\Plugins\freeform\xml\about\BarcodeFont.ttf
c:\program files\Winamp\Plugins\freeform\xml\about\BarcodeFont.txt
c:\program files\Winamp\Plugins\freeform\xml\about\title.png
c:\program files\Winamp\Plugins\freeform\xml\about\wasabi.png
c:\program files\Winamp\Plugins\freeform\xml\checkbox\checkbox.xml
c:\program files\Winamp\Plugins\freeform\xml\combobox\combobox.xml
c:\program files\Winamp\Plugins\freeform\xml\dropdownlist\dropdownlist.xml
c:\program files\Winamp\Plugins\freeform\xml\guiobjects.xml
c:\program files\Winamp\Plugins\freeform\xml\historyeditbox\historyeditbox.m
c:\program files\Winamp\Plugins\freeform\xml\historyeditbox\historyeditbox.maki
c:\program files\Winamp\Plugins\freeform\xml\historyeditbox\historyeditbox.xml
c:\program files\Winamp\Plugins\freeform\xml\menubutton\menubutton.m
c:\program files\Winamp\Plugins\freeform\xml\menubutton\menubutton.maki
c:\program files\Winamp\Plugins\freeform\xml\menubutton\menubutton.xml
c:\program files\Winamp\Plugins\freeform\xml\msgbox\msgbox.xml
c:\program files\Winamp\Plugins\freeform\xml\pathpicker\pathpicker.xml
c:\program files\Winamp\Plugins\freeform\xml\popupmenu\popupitem.m
c:\program files\Winamp\Plugins\freeform\xml\popupmenu\popupitem.maki
c:\program files\Winamp\Plugins\freeform\xml\popupmenu\popupmenu.xml
c:\program files\Winamp\Plugins\freeform\xml\statusbar\statusbar.xml
c:\program files\Winamp\Plugins\freeform\xml\tabsheet\buttons.png
c:\program files\Winamp\Plugins\freeform\xml\tabsheet\tabsheet.xml
c:\program files\Winamp\Plugins\freeform\xml\titlebox\titlebox.xml
c:\program files\Winamp\Plugins\freeform\xml\tooltips\tooltips-elements.png
c:\program files\Winamp\Plugins\freeform\xml\tooltips\tooltips-elements.xml
c:\program files\Winamp\Plugins\freeform\xml\tooltips\tooltips.m
c:\program files\Winamp\Plugins\freeform\xml\tooltips\tooltips.maki
c:\program files\Winamp\Plugins\freeform\xml\tooltips\tooltips.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\fonts\button-font-normal.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\fonts\button-font-small.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\fonts\default-font.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\fonts\titlebar-font.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-button-pressed.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-button.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-left.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-middle.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-right.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\garbage\text_bg.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\menu\background.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\menu\selbar.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\menu\window-elements.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\Scripts\debug.sym
c:\program files\Winamp\Plugins\freeform\xml\wasabi\Scripts\standardframe.m
c:\program files\Winamp\Plugins\freeform\xml\wasabi\Scripts\standardframe.maki
c:\program files\Winamp\Plugins\freeform\xml\wasabi\Scripts\titlebar.m
c:\program files\Winamp\Plugins\freeform\xml\wasabi\Scripts\titlebar.maki
c:\program files\Winamp\Plugins\freeform\xml\wasabi\wasabi.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\window\background.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\window\error.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\window\framewnd-windowshade.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\window\scrollgrips.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\window\transparent.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\window\tree-sort-icon.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\window\window-elements.png
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\components.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\garbage-elements.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\buttonbar.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\objectframe.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\panel.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\window-embedded.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\groups\window.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\old.system-colors.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\old.system-elements.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\system-colors.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\system-element-aliases.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\system-elements.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\system-groups.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\button\button.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\editbox\editbox.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\slider\slider.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\standardframe\standardframe-elements.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\standardframe\standardframe.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\text\text.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\titlebar\titlebar.xml
c:\program files\Winamp\Plugins\freeform\xml\wasabi\xml\xui\xuiobjects.xml
c:\program files\Winamp\Plugins\gen_ff.dll
c:\program files\Winamp\Plugins\gen_hotkeys.dll
c:\program files\Winamp\Plugins\gen_jumpex.dll
c:\program files\Winamp\Plugins\gen_ml.dll
c:\program files\Winamp\Plugins\gen_ml.ini
c:\program files\Winamp\Plugins\gen_tray.dll
c:\program files\Winamp\Plugins\in_cdda.dll
c:\program files\Winamp\Plugins\in_dshow.dll
c:\program files\Winamp\Plugins\in_flac.dll
c:\program files\Winamp\Plugins\in_linein.dll
c:\program files\Winamp\Plugins\in_midi.dll
c:\program files\Winamp\Plugins\in_mod.dll
c:\program files\Winamp\Plugins\in_mp3.dll
c:\program files\Winamp\Plugins\in_mp4.dll
c:\program files\Winamp\Plugins\in_nsv.dll
c:\program files\Winamp\Plugins\in_vorbis.dll
c:\program files\Winamp\Plugins\in_wave.dll
c:\program files\Winamp\Plugins\in_wm.dll
c:\program files\Winamp\Plugins\lame_enc.dll
c:\program files\Winamp\Plugins\milk_img.ini
c:\program files\Winamp\Plugins\milk_msg.ini
c:\program files\Winamp\Plugins\milkdrop.html
c:\program files\Winamp\Plugins\Milkdrop\[Ishan] - Anuera.milk
c:\program files\Winamp\Plugins\Milkdrop\[Ishan] - Devil's Disco Night(Inverted Electron Flow rmx).milk
c:\program files\Winamp\Plugins\Milkdrop\[Ishan] - Devil's Disco Night.milk
c:\program files\Winamp\Plugins\Milkdrop\[Ishan] - Life in the drains.milk
c:\program files\Winamp\Plugins\Milkdrop\[Ishan] - Radicalizing my brain cells.milk
c:\program files\Winamp\Plugins\Milkdrop\[Ishan] - Soul Amplifier(Unreal remix).milk
c:\program files\Winamp\Plugins\Milkdrop\[Ishan] - Soul Amplifier.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Accelerator (Hot Lead Transfusion).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Agitator.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Airhandler (Last Breath - Calm).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Airhandler (Last Breath - Crab).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Airhandler (Principle of Sharing).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Arcworld (Arcwheel - Train Wheel).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Calabi-Jau Space Bar.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Chromatic Abyss (Refined Abyss Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Cinnamon Wrench (Candy Crane).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Contortion (Flair Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Curse of the Mirror Emu.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - ddummyy (04u0404).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Gemstone Factory.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Graft (First Rate Heart).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Gravity Lensing (Psycho Remorse).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Hard Drink (Half-Infinitea).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Kevlar Abyss.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Limit Edition (Some Days).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Madness Teaches us to Fly.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Negative Sun IV.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Potion of Spirits.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Pyrokinesis.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Songflower (Hybrid Plant).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Songflower (Moss Posy).milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Soul Conductor.milk
c:\program files\Winamp\Plugins\Milkdrop\Aderrasi - Straight Tropical Coal (Elysium Channel).milk
c:\program files\Winamp\Plugins\Milkdrop\baked - 4-20 =).milk
c:\program files\Winamp\Plugins\Milkdrop\baked - Baked Dimensions [Bass Trip].milk
c:\program files\Winamp\Plugins\Milkdrop\baked - Chinese Fingerbang (cao ni ma =]) - PieturP colors.milk
c:\program files\Winamp\Plugins\Milkdrop\baked - demon isolation.milk
c:\program files\Winamp\Plugins\Milkdrop\baked - insertion point.milk
c:\program files\Winamp\Plugins\Milkdrop\baked - mushroom rainbows[2].milk
c:\program files\Winamp\Plugins\Milkdrop\baked - mushroom rainbows[acid Storm].milk
c:\program files\Winamp\Plugins\Milkdrop\baked - Narcotic Hypnotic.milk
c:\program files\Winamp\Plugins\Milkdrop\baked - TraPped EnCounter.milk
c:\program files\Winamp\Plugins\Milkdrop\Bmelgren - Acid Iris.milk
c:\program files\Winamp\Plugins\Milkdrop\Bmelgren - Pentultimate Nerual Slipstream (Tweak 2).milk
c:\program files\Winamp\Plugins\Milkdrop\Bmelgren & Krash - Rainbow Orb Peacock (Centred Journey Mix 2).milk
c:\program files\Winamp\Plugins\Milkdrop\Bmelgren & Krash - Rainbow Orb Peacock (Lonely Signal Gone Mad Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Bmelgren & Krash - Rainbow Orb Peacock (Unknowable Mix 5).milk
c:\program files\Winamp\Plugins\Milkdrop\BrainStain-114 outside.milk
c:\program files\Winamp\Plugins\Milkdrop\BrainStain-Blackwidow.milk
c:\program files\Winamp\Plugins\Milkdrop\BrainStain-projection room.milk
c:\program files\Winamp\Plugins\Milkdrop\BrainStain-re entry.milk
c:\program files\Winamp\Plugins\Milkdrop\CatalystTheElder - Geometric_Entertainment_Freaky_Geometry_phat_frame_rate_edit.milk
c:\program files\Winamp\Plugins\Milkdrop\che - adela the flower.milk
c:\program files\Winamp\Plugins\Milkdrop\che - barcode infidelity.milk
c:\program files\Winamp\Plugins\Milkdrop\Che - Burning Hus.milk
c:\program files\Winamp\Plugins\Milkdrop\Che - Escape.milk
c:\program files\Winamp\Plugins\Milkdrop\che - terracarbon stream.milk
c:\program files\Winamp\Plugins\Milkdrop\Che - Watch & Fly.milk
c:\program files\Winamp\Plugins\Milkdrop\DaNOnE - Highway to Heaven (rotating).milk
c:\program files\Winamp\Plugins\Milkdrop\EMPR - Random - Look mama, I'm on TV! 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - angels of decay.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - dark side of the moon (plus a few more hits and a pill).milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 03 music.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 04 music minimal.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 05 and proton lights (+Krash's beat code) _Phat_remix02b.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 05 and proton lights (+Krash's beat code) _Phat_remix03 madhatter_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - glowsticks v2 05 and proton lights (+Krash's beat code) _Phat_remix07 recursive demons.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - heater core C_Phat's_class + sparks_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - heater core C_Phat's_on route_mix+beam.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - multisphere 01 B_Phat_Ra_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - nematodes E daemon.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - pointfield 09 the gases beyond 85c.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - pulsecube ee bounce.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 05 - rave on acid.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 08 - rave on a lot of acid and some K.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 13 - definitive fast.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 13 - definitive.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - repeater 15 - kaleidoscope b.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - sarc c_Phats Zoom Mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - spark C.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - spark C_Phat_Jester_Mix_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. - starburst 10 aurora distalis.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - CAT Scan (Nirvana flux).milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - CAT Scan.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 08 nematode_Teal_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 11 sentinel C_poltergeist_mix response daemon.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 14 sentinel 616.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 18 hallway.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - chasers 19 Portal.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat - cubetrace - v2.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. + Phat + fiShbRaiN + Redi Jedi - pictures of insanity(Run Away! Run Away! mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. 3d-glasses.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. and Zylot - skylight (Stained Glass Majesty mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. and Zylot and Phat - Pointfield 9 (Hypnotic Orbit_bass_responce_mix)_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S. planetfunk-10 - tracers E_phat_edit.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S._Phat Whale_soul-monitor danger - music.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - Arm_upgrades - transformer.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - Flare.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - Flare_dig_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - spectrum bubble field.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - spectrum bubble new colors WF2 chaos theory_cage.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat - spectrum bubble new colors_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Cool Bug v2 + (Krash's beat detection).milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat detached centerpoint_made_for_highest_texture_size.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat detached starpoint_Circle_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer - light in the distance.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer - pulsate B.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer - pulsate nubsy_pointer.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Fractical_dancer.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat last of it's kind_jungle_flower_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat last of it's kind_sinking.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Non-eucliden.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Quadrent_fractal.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Speak with the orb_more_colour_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat Target_practice.milk
c:\program files\Winamp\Plugins\Milkdrop\Eo.S.+Phat_whole_lota_tilein'_goin'_on_v4.milk
c:\program files\Winamp\Plugins\Milkdrop\fiShbRaiN - betelguese.milk
c:\program files\Winamp\Plugins\Milkdrop\fiShbRaiN - blueprint.milk
c:\program files\Winamp\Plugins\Milkdrop\fiShbRaiN - planet x_Phat+Eo.S._inFlux_gravity well mix.milk
c:\program files\Winamp\Plugins\Milkdrop\fiShbRaiN - the machine that conquered the world (domination remix).milk
c:\program files\Winamp\Plugins\Milkdrop\fiShbRaiN - white scream firefly.milk
c:\program files\Winamp\Plugins\Milkdrop\fiShbRaiN - witchcraft.milk
c:\program files\Winamp\Plugins\Milkdrop\fiShbRaiN + Eo.S._Phat - The Machine Final.milk
c:\program files\Winamp\Plugins\Milkdrop\Fvese - Multi Circle.milk
c:\program files\Winamp\Plugins\Milkdrop\Fvese - Round and Round (geiss gamma mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Fvese - Snowflake Like 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Fvese - The Tunnel (Final Stage Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Fvese - Zoom Effects (Remix 2).milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Aieeeeee!!!.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Asymptote.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Bass Kaleidosphere.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Bass Zoom.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Bipolar 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Bipolar 5.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Bonfire.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Bright Fiber Matrix 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Calligraphy.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Cartographie.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Cepiasound.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Color Tones 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Constant Velocity.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Corpus Callosum.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Cosmic Dust 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Cosmic Dust 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Cruzin'.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Cycloid 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Davod The Pod.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - De La Moutard 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Descent.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Digital Smoke.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Downward Spiral.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Dynamic Swirls 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Eddies 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Eggs.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - El Cubismo.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Feedback 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Festive.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Fiberglass.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Flotsam.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Flower Blossom.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Four Kinds of Amphetamines.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Galaxy 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Greenland.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Happy Drops.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Heavenly 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - High Dynamic Range.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Hovering.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Hurricane.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Hyperion.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Inkblot.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Iris.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Julia Fractal 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Many Colors 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Mega Swirl 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Mega Swirl 3.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Microcosm.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Music Box.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Octopus Ever Changing.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Octopus Gold with Dots.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Octopus.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Pelota De Fuego.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Pistons.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Planet 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Reducto Absurdum.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Reducto Ad Nauseum.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Rocket.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Runoff.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Script.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Serpent.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Shake.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Shift.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Sinews 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Solar Flare.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Space Voyage (High-Warp).milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Spacedust.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Starfish 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Supernova 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Surface.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Swirl 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Swirlie 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Swirlie 4.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Swirlie 5.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Three And A Half Kinds Of Amphetamines.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Trampoline.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Two-Pointed Pulsagon.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Ultrafast.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Volume Zoom.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Vortex 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Warp Of Dali 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss - Waterfall.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss & Rovastar - Notions Of Tonality 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss & Rovastar - The Chaos Of Colours (sprouting dimentia mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss & Rovastar - Tokamak (Naked Intrusion Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Geiss & TobiasWolfBoi - Cataract Slipstream.milk
c:\program files\Winamp\Plugins\Milkdrop\Idiot - Cortex (Spiritual Visions Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\idiot - Forty Six and 2 (pushit!).milk
c:\program files\Winamp\Plugins\Milkdrop\idiot - Forty Six and 2.milk
c:\program files\Winamp\Plugins\Milkdrop\idiot - Nucleus.milk
c:\program files\Winamp\Plugins\Milkdrop\idiot - Random Water Colours (Justify my stupidity).milk
c:\program files\Winamp\Plugins\Milkdrop\idiot - Random Water Colours.milk
c:\program files\Winamp\Plugins\Milkdrop\Idiot - Tentacle Dreams (Remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Idiot - Typomatic (Remix 2).milk
c:\program files\Winamp\Plugins\Milkdrop\Idiot - What Is.milk
c:\program files\Winamp\Plugins\Milkdrop\Idiot & Che - Various Abstract Effects.milk
c:\program files\Winamp\Plugins\Milkdrop\Illusion - Heavenly Eye.milk
c:\program files\Winamp\Plugins\Milkdrop\Illusion & Rovastar - Clouded Bottle.milk
c:\program files\Winamp\Plugins\Milkdrop\Illusion & Unchained - Frozen Eye 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Digital Flame.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Dynamic Borders 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Heatwaves.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - interwoven (nightmare weft).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - interwoven (nightmare weft)_Phats_Maybe_Ill_Go_To_A_Party.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Molten Indecision (Rozzor Hot Fast tweak).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Snowflake Halo.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - systolic pressure (Eo.S. remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Twisting Indecision.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Vinyl Disk.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - War Machine (Shifting Complexity Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash - Windowframe To Mega Swirl 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Fvese - Molten Indecision (Fvese Remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Idiot - Memories Of The Castle.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Illusion - Spiral Movement.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - A Million Miles from Earth (Ripple Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Altars Of Madness (Mad Ocean Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S Golden Remix.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. hall of ghouls Remix.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Killer Death Bunny Remix.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Moire Remix.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Stars Remix.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Vortex Remix.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Cerebral Demons (Distant Memory Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Rainbow Orb.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - Switching Polygons.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Rovastar - The Devil Is In The Details.milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Telek - Real Noughts and Crosses (Random Ending).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash & Zylot - Inside The Planar Portal (Indecision Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Krash + Eo.S. - Photographic Sentinel.milk
c:\program files\Winamp\Plugins\Milkdrop\Mstress - Acid Universes (Big Bang Interferences Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Mstress - Acid Universes.milk
c:\program files\Winamp\Plugins\Milkdrop\Mstress - Acoustic Nerve Impulses (Primary Colors Of Sound Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Mstress - Snowing Fiber City.milk
c:\program files\Winamp\Plugins\Milkdrop\Mstress & Darius - Pursuing The Sunset.milk
c:\program files\Winamp\Plugins\Milkdrop\Mstress & Juppy - Dancer.milk
c:\program files\Winamp\Plugins\Milkdrop\Mstress & Zylot - Acid UFO.milk
c:\program files\Winamp\Plugins\Milkdrop\mstress and rovastar - carnival of madness (dancing worms) Studio Music Mod.milk
c:\program files\Winamp\Plugins\Milkdrop\nil - Cid and Lucy.milk
c:\program files\Winamp\Plugins\Milkdrop\nil - Disco Comet.milk
c:\program files\Winamp\Plugins\Milkdrop\nil - Vortex of Vortices.milk
c:\program files\Winamp\Plugins\Milkdrop\nil & EMPR - Electron Flow (Copper Wire Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\nil & EMPR - Ruby Nirvana.milk
c:\program files\Winamp\Plugins\Milkdrop\phat + Eo.S. - Bass_responce_Red_Movements_Disorienting nebula3.milk
c:\program files\Winamp\Plugins\Milkdrop\phat + Eo.S. - ouch.milk
c:\program files\Winamp\Plugins\Milkdrop\phat + Eo.S. - single cel angel birth.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat and Eo.S. _ shapes are cool smoke move2.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Eo.S. Eyes_spiral_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Eo.S. rainbow bubble_mid3-###### me dood.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Eo.S._Data_swimmer.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Eo.S._Swim_waveform_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. I_hope_someone_will_see_this_triping_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. rainbow bubble_mid3-###### me dood-flash.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. spiral_faces_ravers_phantom.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat_Zylot_Eo.S. work with lines.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat+Eo.S_Mandala_Chasers_remix_Circles_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat+Eo.S_Mandala_Chasers_remix_spectrum.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat+fiShbRaiN+Eo.S_Mandala_Chasers_remix - www.eos4life.com.milk
c:\program files\Winamp\Plugins\Milkdrop\Phat+fiShbRaiN+Eo.S_Mandala_Chasers_remix.milk
c:\program files\Winamp\Plugins\Milkdrop\PieturP - triptrap_(getting_concrete_visions_through_a_diafragma_version).milk
c:\program files\Winamp\Plugins\Milkdrop\PieturP - triptrap_(ultimate-trip-mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - acid in your brain.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - acid in your pants.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane 2 hits please.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane. no more!.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - acid on a window pane2.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - atomic reaction.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - atoms in hell.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - brainfart remix.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - i dont think those were portabello mushrooms.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - i think i took a wrong turn in a bad part of town.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - i was here till this came on.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - multiple points of origin, one destination.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - my pupil is big.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - off the fadar (no sweeps or bleeps, but alotta creeps).milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - off the fadar.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - perplexium.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - pladman visits the sevendys.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - pladman.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - porthole to the underworld(dround in a vat of milk).milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - porthole to the underworld(hit by a bus edition).milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - quit smoking my water,you dick.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - static fusion.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - static ideas in a dynamic world.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - subspace of reality.milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - triptacular to the max(maxtacular to the trip remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - welcome to the underworld(remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Redi Jedi - your radar may have a few kinks in it.milk
c:\program files\Winamp\Plugins\Milkdrop\Reenen - phoenix.milk
c:\program files\Winamp\Plugins\Milkdrop\Rocke - Cold Love (Tei Zwaa).milk
c:\program files\Winamp\Plugins\Milkdrop\Rocke - Personal Comet.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - A Million Miles From Earth (Drift Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - A Million Miles From Earth (Wormhole Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - A Million Miles from Earth.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Harlequin's Madness (Dark Disorder Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Harlequin's Madness.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Madness (Boxfresh Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Altars Of Madness 4 (Spirit Of Twisted Madness Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Braindance 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Chapel Of Ghouls (Havok Plasma Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Chemical Spirituality.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Dark Ritual (Star Of Destiny Denied Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Dark Ritual (Star Of Destiny Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Demon Sunflower (Double Resistance Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Dreamcatcher.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Explosive Minds.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Eye On Reality (Mega 3 Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Forgotten Moon.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Fantic Dancing Lights Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Galaxy Swirl Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Upspoken Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Fractopia (Upspoken Mix)_Phat_Speak_When_Spoken_2.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Halcyon Dreams 3.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Delight (Endless Tunnel Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Dynamic Fractal (Dual Spiral Mix ).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Dynamic Fractal 1.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Dynamic Fractal 3.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Fractal Encounter 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Fractal Encounter.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Liquid Dragon.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Living Wall.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Harlequin's Spirit (Twisted Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Hyperspace.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Inner Thoughts (Bright Dawn Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Jester's Awakening.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Jester's Calling 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Mosaics Of Ages.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Omnipresence Resurrection (Raw Mix)_Phat_Plazma_Soul_2.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Oozing Resistance.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Paradigm Sphere.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Power Trip.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Sea Life.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Sea Shells.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Snapshot Of Space.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Solarized Space (Space DNA Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Solarized Space.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Starquake (Sunquake Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - The Chaos Of Colours.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - The Shroomery.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Timeless Voyage.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Tripmaker (Space Trip Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Tripmaker.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - Trippy S..milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Brainwaves.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Movement (After Dark Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Movement.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar - VooV's Organic Light.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Che - Adela The Flower (Altars Of Madness Mix 2).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Che - Asylum Animations.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Che - Definitly Not For The Epileptic (Inner Perspective Of Life Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Fvese - Dark Subconscious.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Fvese - Mosaic Waves.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Fvese - Paranormal Static.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Dynamic Swirls 3 (Broken Destiny Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Dynamic Swirls 3 (Smoke Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Dynamic Swirls 3 (Voyage Of Twisted Souls Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Hurricane Nightmare.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Ice Planet.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Geiss - Octoplasm.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Idiot24-7 - Balk Acid.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Idiot24-7 - Mixed Emotions (Harlequin's Shame Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Krash - Cerebral Demons.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Krash - Rainbow Deflection.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Krash - Sweetness & Light.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Loadus - FractalDrop (Active Sparks Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Rocke - Sugar Spun Sister.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Telek - Altars of Madness (Rolling Oceans Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Ambrosia Mystic (Dark Heart Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Demonology (Vampire Soul Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Unclaimed Wreckage 2 (Mystic Stake Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Unchained - Voodoo Chess Magnet (Everglow Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Azirphaeli's Plan (Multiplan Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Crystal Ball (Many Visions Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Inside The Transdimensional Portal.milk
c:\program files\Winamp\Plugins\Milkdrop\Rovastar & Zylot - Narell's Fever.milk
c:\program files\Winamp\Plugins\Milkdrop\Rozzor - Color Breaks its Boycott (shape mod).milk
c:\program files\Winamp\Plugins\Milkdrop\Rozzor & Rovastar - Altars Of Madness 3 (ooze tweak with custom wave).milk
c:\program files\Winamp\Plugins\Milkdrop\Rozzor & StudioMusic - Vertigyny (Geiss shape mod).milk
c:\program files\Winamp\Plugins\Milkdrop\Rozzor and Idiot - Any Other Deep Rising.milk
c:\program files\Winamp\Plugins\Milkdrop\Scanner (@ztec)2.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - a thousand monkeys_phat_edit (subliminal mix).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - artefact.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - brain coral (left brained).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - brain coral.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - cellular_Phat_Spinny_Slide_mix_v2_Time_Mod_tan.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - cellular_Phat_Spinny_Swimmer_mix_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - cellular_Phat_YAK_Infusion_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - deep sea hydra spectrum.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - digi.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - escape the worm - Eo.S. + Phat - Before_It_Eats_Your_Brain_Mix_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - escape the worm - Eo.S. + Phat 5362.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - feathers (angel wings).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - fractal grinder (opalescent).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - fractal grinder.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - fuzzball.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - glassworms flare.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - kiwi fruit.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - lattice (eclipse) Phat + Eo.S. more color mix_v2.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - lazerspecs_phat_edit.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - mandala.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - morphid.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - neon pulse (reactive).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - pipes (metallic).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - ralter oilslick b.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - robotopia.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - spincycle c.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - swarm.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - tadpole evolution (static mix).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - tumbling cubes.milk
c:\program files\Winamp\Plugins\Milkdrop\shifter - urchin mod.milk
c:\program files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (Bubble Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (inside the neural net).milk
c:\program files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (shattered mind).milk
c:\program files\Winamp\Plugins\Milkdrop\Shifter & Eo.S+Phat - Fractical dancer (Slide Plane).milk
c:\program files\Winamp\Plugins\Milkdrop\shifter & fiShbRaiN - witchcraft (i'm melting).milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music - (Sex is like math) Add the bed, subtract the clothes, divide the legs and hope to hell you don't multiply.milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music - Cherished Desires.milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music - Intuitive Awareness (stimulus effect mix) .milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music - Intuitive Awareness (Traces of Love mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music - Personification.milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music - Quick Fix (dramatic mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music - Take Your Pick (Remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music & Unchained - Just Ain't Right (It's alright though Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music & Unchained + Phat and E.o.S - How it feel's to be Alive.milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music and Redi Jedi - Passionate Behavior.milk
c:\program files\Winamp\Plugins\Milkdrop\Studio Music and Redi Jedi - Shimmering Love (remix).milk
c:\program files\Winamp\Plugins\Milkdrop\StudioMusic - Harmonic Bliss (elated mix).milk
c:\program files\Winamp\Plugins\Milkdrop\StudioMusic - Twisted Galaxy.milk
c:\program files\Winamp\Plugins\Milkdrop\Tag - Cradle of Life(remix of yin 315).milk
c:\program files\Winamp\Plugins\Milkdrop\TEcHNO & SandStorm - Psychodelic Highway.milk
c:\program files\Winamp\Plugins\Milkdrop\Telek - City Helix Lattice.milk
c:\program files\Winamp\Plugins\Milkdrop\Telek - Directive Swagger (Spectral Inferno) (fix…) maybe.. YES.milk
c:\program files\Winamp\Plugins\Milkdrop\Telek - Globetrotting (Sailors Delight Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Telek - Slow Shift Matrix (bb4.5).milk
c:\program files\Winamp\Plugins\Milkdrop\Telek - Target Practice (tracking, retreat, slide).milk
c:\program files\Winamp\Plugins\Milkdrop\Telek EMPR - Scanner - Trust me, I've got a Melways.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - A Matter Of Taste (Remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - All You Can Eat.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Beat Demo (Demonology Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Beat Demo 1.0.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Cartoon Factory.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Cranked On Failure.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Custom Gramatix (Remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - French Clothing.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Games With Light & Sound.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - God Of The Game (Remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Goo Kung Fu.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Goofy Beat Detection.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Housed In A Childish Mind.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Jaded Emotion.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Jaundice.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Making a Science of It 4.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Morat's Final Voyage.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Painful Plasma (Multi-Wave Mirrored Rage) – Rozzor triangle tweak.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Perverted Dialect.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Picture Of Poison.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Proper Identification (Breaks Remix).milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Resistance.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Ribald Ballad.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Unclaimed Wreckage 2 (Shamanic).milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained - Unified Drag 2.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained & Che - Oddnezz 3.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained & Illusion - Logic Morph.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained & Rovastar - Rainbow Obscura.milk
c:\program files\Winamp\Plugins\Milkdrop\Unchained & Rovastar - Xen Traffic.milk
c:\program files\Winamp\Plugins\Milkdrop\Valhala - Core.milk
c:\program files\Winamp\Plugins\Milkdrop\Valhala - FallingUp.milk
c:\program files\Winamp\Plugins\Milkdrop\Valhala - HappyTrip.milk
c:\program files\Winamp\Plugins\Milkdrop\Valhala - Sound Reactror.milk
c:\program files\Winamp\Plugins\Milkdrop\Valhala - The all seeing eyeV0.4.milk
c:\program files\Winamp\Plugins\Milkdrop\Vovan - Bass With Flover.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 240 - Electric universe.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 250 - Artificial poles of the continuum.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 250 - Artificial poles of the continuum_Phat's_star_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 253 - Artificial poles of the continuum (remix #3).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 280 - Coming home.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 290 - Sonic brainstorm.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 293 - Sonic brainstorm (inner state - group experience mix).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 300 - Daydreamer.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 302 - Daydreamer (remix 2).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 311 - Ocean of Light (bouncing off mix).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 313 - Ocean of Light (ESP).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 315 - Ocean of Light (yo im peakin yo Eo.S.-Phat).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 317 - Ocean of Light (y remix).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 321 - Pastel fantasies (remix).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 324 - Pastel fantasies (beat sensitive liquid heaven color leak mix).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 325 - Pastel fantasies (angelic intervention).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 326 - Pastel fantasies (angelic intervention harmonic solo)_Phats_slow_mix.milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 327 - Pastel fantasies (freeform funk).milk
c:\program files\Winamp\Plugins\Milkdrop\yin - 340 - Under the sun (resonant consciousness 2005).milk
c:\program files\Winamp\Plugins\Milkdrop\yin + Phat + Eo.S. - Dreams of Blood.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Block Of Sound (Abstract Architecture Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Block Of Sound (Fractal Construction Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Burning Passion.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Color Of Music.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Crosshair Dimension (Light of Ages).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Digiscape Advanced Processor.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - DISCO INFERNO.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Fusion.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - light of the path.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Magma Crawl.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Mixing Pot.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Present for Saddam.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Psyonist (New Eyes Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Rainbow Planet Under Attack.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Riding The Sound Waves.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Rush.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - S. Pulse Virus.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Spiral (Hypnotic)_Phat_Double_Spiral_Mix.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Tunnel Of Illusion.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Visionarie (geiss aspect ratio fix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot - Wisps.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot & Aderrasi - Oceanic Bassograph (New Jersey Shore Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot & Boz - Spirit Energy (Angry Soul's reMix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot & Idiot - ATan2 Demo (Spiraling Mad Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot & Krash - Extremophile.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot & Mstress - Celebrate.milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot & Rovastar - Crystal Ball (Cerimonial Decor Mix).milk
c:\program files\Winamp\Plugins\Milkdrop\Zylot & Rovastar - Iouo Stone Morphic Fusion.milk
c:\program files\Winamp\Plugins\milkdrop_preset_authoring.html
c:\program files\Winamp\Plugins\ml\feeds.xml
c:\program files\Winamp\Plugins\ml\main.dat
c:\program files\Winamp\Plugins\ml\main.idx
c:\program files\Winamp\Plugins\ml\met7EF6.vmd
c:\program files\Winamp\Plugins\ml\met8EC8.vmd
c:\program files\Winamp\Plugins\ml\met9E9A.vmd
c:\program files\Winamp\Plugins\ml\metAE6C.vmd
c:\program files\Winamp\Plugins\ml\metBE3E.vmd
c:\program files\Winamp\Plugins\ml\metCE10.vmd
c:\program files\Winamp\Plugins\ml\metDDE2.vmd
c:\program files\Winamp\Plugins\ml\ml_dash.ini
c:\program files\Winamp\Plugins\ml\ml_online.ini
c:\program files\Winamp\Plugins\ml\playlists.xml
c:\program files\Winamp\Plugins\ml\recent.dat
c:\program files\Winamp\Plugins\ml\recent.idx
c:\program files\Winamp\Plugins\ml\rss.xml
c:\program files\Winamp\Plugins\ml_bookmarks.dll
c:\program files\Winamp\Plugins\ml_dash.dll
c:\program files\Winamp\Plugins\ml_disc.dll
c:\program files\Winamp\Plugins\ml_history.dll
c:\program files\Winamp\Plugins\ml_local.dll
c:\program files\Winamp\Plugins\ml_nowplaying.dll
c:\program files\Winamp\Plugins\ml_online.dll
c:\program files\Winamp\Plugins\ml_playlists.dll
c:\program files\Winamp\Plugins\ml_pmp.dll
c:\program files\Winamp\Plugins\ml_rg.dll
c:\program files\Winamp\Plugins\ml_wire.dll
c:\program files\Winamp\Plugins\ml_xpdxs.dll
c:\program files\Winamp\Plugins\nscrt.dll
c:\program files\Winamp\Plugins\nsvdec_vp5.dll
c:\program files\Winamp\Plugins\nsvdec_vp6.dll
c:\program files\Winamp\Plugins\out_disk.dll
c:\program files\Winamp\Plugins\out_ds.dll
c:\program files\Winamp\Plugins\out_wave.dll
c:\program files\Winamp\Plugins\pmp_ipod.dll
c:\program files\Winamp\Plugins\pmp_njb.dll
c:\program files\Winamp\Plugins\pmp_p4s.dll
c:\program files\Winamp\Plugins\pmp_usb.dll
c:\program files\Winamp\Plugins\Predixis MusicMagic\help.htm
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\media_library.jpg
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\media_library_button_row.jpg
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\musicmagic_plugin.jpg
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\musicmagic_recommendations.jpg
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Predixis_WinAmpScrnLogo.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_BL_Cornr.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_BottomStretchr.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_BR_Cornr.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_LeftStretchr.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_RightStretchr.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_TopL_Cornr.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_topStretcher.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\Winamp_TR_Cornr.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\WinampParty.jpg
c:\program files\Winamp\Plugins\Predixis MusicMagic\images\WinAmpScreen1HDR.gif
c:\program files\Winamp\Plugins\Predixis MusicMagic\index.htm
c:\program files\Winamp\Plugins\Predixis MusicMagic\predixis_winamp.css
c:\program files\Winamp\Plugins\q_and_t_vars.gif
c:\program files\Winamp\Plugins\read_file.dll
c:\program files\Winamp\Plugins\ReplayGainAnalysis.dll
c:\program files\Winamp\Plugins\vis_avs.dat
c:\program files\Winamp\Plugins\vis_avs.dll
c:\program files\Winamp\Plugins\vis_milk.dll
c:\program files\Winamp\Plugins\vis_nsfs.dll
c:\program files\Winamp\Plugins\vms_desktop.dll
c:\program files\Winamp\primosdk.DLL
c:\program files\Winamp\Skins\Winamp Modern\about\about.maki
c:\program files\Winamp\Skins\Winamp Modern\about\about.xml
c:\program files\Winamp\Skins\Winamp Modern\about\about_bg.png
c:\program files\Winamp\Skins\Winamp Modern\about\about_bolt.png
c:\program files\Winamp\Skins\Winamp Modern\about\about_fg.png
c:\program files\Winamp\Skins\Winamp Modern\about\about_star.png
c:\program files\Winamp\Skins\Winamp Modern\about\eye.png
c:\program files\Winamp\Skins\Winamp Modern\notifier\notif-bg-alpha.png
c:\program files\Winamp\Skins\Winamp Modern\notifier\notif-bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\beat_displayoverlay.png
c:\program files\Winamp\Skins\Winamp Modern\player\beat_l2.png
c:\program files\Winamp\Skins\Winamp Modern\player\beat_left.png
c:\program files\Winamp\Skins\Winamp Modern\player\beat_r2.png
c:\program files\Winamp\Skins\Winamp Modern\player\beat_right.png
c:\program files\Winamp\Skins\Winamp Modern\player\beat_textoverlay.png
c:\program files\Winamp\Skins\Winamp Modern\player\bolt.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_balance.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_config_drawer.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_ct_switch.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_eq.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_mute.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_mute_bg.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\button_repeat2.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_shufflerepeat.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_videoavs.png
c:\program files\Winamp\Skins\Winamp Modern\player\button_volume.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_detach.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_eq.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_mlpl.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_mlpl_bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_pl.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_switchto.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_video.png
c:\program files\Winamp\Skins\Winamp Modern\player\buttons_vis.png
c:\program files\Winamp\Skins\Winamp Modern\player\config_tabs.png
c:\program files\Winamp\Skins\Winamp Modern\player\ct_background.png
c:\program files\Winamp\Skins\Winamp Modern\player\ct_bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\display.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\displayoverlay.png
c:\program files\Winamp\Skins\Winamp Modern\player\drawer_bg.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\drawer_bg_regions.png
c:\program files\Winamp\Skins\Winamp Modern\player\drawer_shadow.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\eq_balance.png
c:\program files\Winamp\Skins\Winamp Modern\player\Eq_bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\eq_textoverlay.png
c:\program files\Winamp\Skins\Winamp Modern\player\main_bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\mainregions.png
c:\program files\Winamp\Skins\Winamp Modern\player\menubar.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\numfont.png
c:\program files\Winamp\Skins\Winamp Modern\player\openclose_overlay.png
c:\program files\Winamp\Skins\Winamp Modern\player\options_bg.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\Options_buttons.png
c:\program files\Winamp\Skins\Winamp Modern\player\options_buttons2.png
c:\program files\Winamp\Skins\Winamp Modern\player\Options_elements.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\options_more.png
c:\program files\Winamp\Skins\Winamp Modern\player\options_scrollbuttons.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\options_slider.png
c:\program files\Winamp\Skins\Winamp Modern\player\pe_time.png
c:\program files\Winamp\Skins\Winamp Modern\player\pe_time_font.png
c:\program files\Winamp\Skins\Winamp Modern\player\playbackstatus.png
c:\program files\Winamp\Skins\Winamp Modern\player\player_buttons.png
c:\program files\Winamp\Skins\Winamp Modern\player\player_buttons_status.png
c:\program files\Winamp\Skins\Winamp Modern\player\progressbar.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\resize_pl.png
c:\program files\Winamp\Skins\Winamp Modern\player\resizer.png
c:\program files\Winamp\Skins\Winamp Modern\player\seekbar.png
c:\program files\Winamp\Skins\Winamp Modern\player\seekpos.png
c:\program files\Winamp\Skins\Winamp Modern\player\shufflerepeat_bg.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\shufflerepeat_led.png
c:\program files\Winamp\Skins\Winamp Modern\player\smallfont.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\songinfo.png
c:\program files\Winamp\Skins\Winamp Modern\player\songinfofont.png
c:\program files\Winamp\Skins\Winamp Modern\player\Songtickerfont.png
c:\program files\Winamp\Skins\Winamp Modern\player\txt_config.PNG
c:\program files\Winamp\Skins\Winamp Modern\player\videoavs_bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\videoavs_button_bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\videoavs_button_bg2.png
c:\program files\Winamp\Skins\Winamp Modern\player\videoavs_button_overlay.png
c:\program files\Winamp\Skins\Winamp Modern\player\videoavs_buttonup_bg.png
c:\program files\Winamp\Skins\Winamp Modern\player\videoavs_buttonup_bg2.png
c:\program files\Winamp\Skins\Winamp Modern\player\visualization_background.png
c:\program files\Winamp\Skins\Winamp Modern\player\visualization_overlay.png
c:\program files\Winamp\Skins\Winamp Modern\player\volume_bar_bg.png
c:\program files\Winamp\Skins\Winamp Modern\scripts\attribs.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\beatvisualization.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\beatvisualization.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\buildall.bat
c:\program files\Winamp\Skins\Winamp Modern\scripts\configtabs.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\configtabs.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\configtarget.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\configtarget.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\crossfade.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\crossfade.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\debug.sym
c:\program files\Winamp\Skins\Winamp Modern\scripts\display.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\display.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\drawer.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\eq.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\eq.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\mainmenu.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\mainmenu.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\mainmenuoverlay.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\mainmenuoverlay.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\mlmenu.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\mlmenu.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\mute.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\mute.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\notifications_fade_times.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\notifier.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\notifier.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\plmenu.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\plmenu.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\pltime.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\pltime.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\seek.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\seek.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\seekshade.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\seekshade.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\shadecontrol.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\shadecontrol.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\shadesizepos.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\shadesizepos.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\songinfo.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\songinfo.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\standardframe.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\standardframe.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\titlebar.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\titlebar.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\video.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\video.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\videoavs.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\videoavs.maki
c:\program files\Winamp\Skins\Winamp Modern\scripts\vis.m
c:\program files\Winamp\Skins\Winamp Modern\scripts\vis.maki
c:\program files\Winamp\Skins\Winamp Modern\shade\bg_overlay.png
c:\program files\Winamp\Skins\Winamp Modern\shade\buttons.png
c:\program files\Winamp\Skins\Winamp Modern\shade\buttons_bg.png
c:\program files\Winamp\Skins\Winamp Modern\shade\buttons2.PNG
c:\program files\Winamp\Skins\Winamp Modern\shade\corners.png
c:\program files\Winamp\Skins\Winamp Modern\shade\display_overlay.png
c:\program files\Winamp\Skins\Winamp Modern\shade\led.png
c:\program files\Winamp\Skins\Winamp Modern\shade\pl_shade.png
c:\program files\Winamp\Skins\Winamp Modern\shade\playbackstatus.png
c:\program files\Winamp\Skins\Winamp Modern\shade\seek.png
c:\program files\Winamp\Skins\Winamp Modern\shade\shade_bg.PNG
c:\program files\Winamp\Skins\Winamp Modern\shade\songtickerfont.PNG
c:\program files\Winamp\Skins\Winamp Modern\shade\volume.png
c:\program files\Winamp\Skins\Winamp Modern\skin.xml
c:\program files\Winamp\Skins\Winamp Modern\standardframe\standardframe-elements.xml
c:\program files\Winamp\Skins\Winamp Modern\standardframe\standardframe.xml
c:\program files\Winamp\Skins\Winamp Modern\standardframe\window_menus.xml
c:\program files\Winamp\Skins\Winamp Modern\titlebar\titlebar.xml
c:\program files\Winamp\Skins\Winamp Modern\window\background.png
c:\program files\Winamp\Skins\Winamp Modern\window\main.png
c:\program files\Winamp\Skins\Winamp Modern\window\main2.png
c:\program files\Winamp\Skins\Winamp Modern\window\menu.png
c:\program files\Winamp\Skins\Winamp Modern\window\mlwindow.png
c:\program files\Winamp\Skins\Winamp Modern\window\plwindow.png
c:\program files\Winamp\Skins\Winamp Modern\window\scrollbars.png
c:\program files\Winamp\Skins\Winamp Modern\window\Scrollgrips.png
c:\program files\Winamp\Skins\Winamp Modern\window\titlebar.png
c:\program files\Winamp\Skins\Winamp Modern\window\titlebar_overlay.png
c:\program files\Winamp\Skins\Winamp Modern\window\wasabi_window.PNG
c:\program files\Winamp\Skins\Winamp Modern\window\window-elements.png
c:\program files\Winamp\Skins\Winamp Modern\xml\color-presets.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\configdrawer.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\ml-normal.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\ml.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\notifier-elements.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\notifier-normal.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\notifier.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\player-elements-shade.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\player-elements.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\player-normal-group.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\player-normal.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\player-shade-group.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\player-shade.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\player.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\pledit-normal.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\pledit-shade-group.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\pledit-shade.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\pledit.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\system-colors.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\video-normal.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\video.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\vis-normal.xml
c:\program files\Winamp\Skins\Winamp Modern\xml\vis.xml
c:\program files\Winamp\System\aacPlusDecoder.w5s
c:\program files\Winamp\System\db.w5s
c:\program files\Winamp\System\filereader.w5s
c:\program files\Winamp\System\jnetlib.w5s
c:\program files\Winamp\System\jpeg.w5s
c:\program files\Winamp\System\playlist.w5s
c:\program files\Winamp\System\png.w5s
c:\program files\Winamp\System\tagz.w5s
c:\program files\Winamp\System\watcher.w5s
c:\program files\Winamp\System\xml.w5s
c:\program files\Winamp\UninstWA.exe
c:\program files\Winamp\whatsnew.txt
c:\program files\Winamp\winamp.exe
c:\program files\Winamp\Winamp.ini
c:\program files\Winamp\winamp.m3u
c:\program files\Winamp\Winamp.m3u8
c:\program files\Winamp\Winamp.q1
c:\program files\Winamp\winampa .exe

c:\windows\system32\DRIVERS\atapi.sys . . . is infected!! . . .Failed to restore. Attempting to replace on reboot

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - c:\system volume information\_restore{E2D90753-936E-4822-8202-8738DF16047E}\RP35\A0065049.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_CTJJSV
——-\Legacy_DNIPFW
——-\Legacy_LQQVEEJFH
——-\Service_ctjjsv
——-\Service_dnipfw
——-\Service_lqqveejfh
——-\Legacy_NMIndexingService
——-\Service_NMIndexingService


((((((((((((((((((((((((( Files Created from 2009-12-07 to 2010-01-07 )))))))))))))))))))))))))))))))
.

2010-01-04 21:28 . 2010-01-04 21:28 ——– d—–w- c:\documents and settings\user\Application Data\PlayFirst
2010-01-04 21:28 . 2010-01-04 21:28 ——– d—–w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-12-29 17:02 . 2009-12-29 17:02 ——– d—–w- c:\program files\Trend Micro
2009-12-25 04:03 . 2009-06-30 17:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2009-12-25 04:01 . 2009-12-25 04:01 ——– d—–w- c:\program files\Panda Security
2009-12-24 09:34 . 2009-12-24 09:34 ——– d—–w- c:\documents and settings\user\Application Data\Malwarebytes
2009-12-24 09:32 . 2009-12-04 00:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-24 09:32 . 2009-12-24 09:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-24 09:32 . 2009-12-24 09:34 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-24 09:32 . 2009-12-04 00:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-24 09:27 . 2009-12-24 09:28 ——– d—–w- c:\program files\ERUNT
2009-12-24 00:11 . 2009-12-24 00:11 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-12-24 00:11 . 2009-12-24 00:11 ——– d—–w- c:\documents and settings\user\Local Settings\Application Data\SupportSoft
2009-12-24 00:11 . 2009-12-24 00:11 ——– d—–w- c:\program files\Common Files\SupportSoft
2009-12-24 00:11 . 2009-12-24 00:11 ——– d—–w- c:\documents and settings\All Users\Application Data\SupportSoft
2009-12-24 00:10 . 2009-12-24 00:10 ——– d—–w- c:\program files\Globe Telecom
2009-12-23 00:00 . 2009-12-23 00:00 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-12-22 23:59 . 2009-12-22 23:59 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-12-21 03:11 . 2009-12-21 03:11 ——– d—–w- C:\CFLog
2009-12-21 01:19 . 2001-08-18 06:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2009-12-21 01:19 . 2004-08-04 08:56 159232 —-a-w- c:\windows\system32\ptpusd.dll
2009-12-21 01:19 . 2004-08-04 06:58 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2009-12-21 01:19 . 2004-08-04 06:58 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 07:52 . 2009-09-10 17:20 ——– d—–w- c:\program files\MYGAME Launcher
2009-12-26 17:05 . 2009-07-18 08:01 ——– d—–w- c:\documents and settings\user\Application Data\Wildfire
2009-12-24 05:08 . 2009-12-24 05:08 117760 —-a-w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-24 05:07 . 2009-11-01 20:06 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-12-24 05:07 . 2009-11-01 20:06 ——– d—–w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com
2009-12-24 05:07 . 2009-03-31 16:27 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-24 04:40 . 2009-11-27 04:01 ——– d—–w- c:\documents and settings\user\Application Data\BitTorrent
2009-12-20 17:29 . 2009-03-31 02:58 26 —-a-w- c:\windows\popcinfo.dat
2009-12-20 05:20 . 2009-04-28 04:32 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-20 05:20 . 2009-12-02 02:17 ——– d—–w- c:\documents and settings\user\Application Data\Pharaohs Secret
2009-12-06 16:05 . 2009-04-17 05:35 ——– d—–w- c:\program files\Level Up Games
2009-12-06 15:04 . 2009-06-25 19:57 ——– d—–w- c:\program files\Reflexive
2009-12-06 15:04 . 2009-08-07 02:46 ——– d—–w- c:\program files\ToGo Game
2009-12-05 06:24 . 2009-12-05 06:24 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-05 06:23 . 2009-12-05 06:23 ——– d—–w- c:\program files\Java
2009-12-05 06:23 . 2009-12-05 06:23 152576 —-a-w- c:\documents and settings\user\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-12-03 00:19 . 2009-11-01 19:48 25 —-a-w- c:\windows\popcinfot.dat
2009-12-02 16:14 . 2009-04-14 05:23 ——– d—–w- c:\program files\Common Files\LightScribe
2009-12-02 06:45 . 2009-12-02 06:45 ——– d—–w- c:\documents and settings\user\Application Data\Orneon
2009-12-02 02:17 . 2009-12-02 02:17 ——– d—–w- c:\program files\SpintopGames
2009-12-01 06:42 . 2009-12-01 06:42 ——– d—–w- c:\documents and settings\user\Application Data\Autodesk
2009-11-30 04:37 . 2009-11-30 04:37 ——– d—–w- c:\program files\Games
2009-11-27 13:34 . 2009-11-27 13:34 8854 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\UNINST_Uninstall_T_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 4286 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Amped_Website.url1_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 4286 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Amped_Website.url_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra_PH_Website._ACB5EAD4CD3E428DBACCD9790AABE3AF_1.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra_PH_Website._ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra.exe1_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\Tantra.exe_ACB5EAD4CD3E428DBACCD9790AABE3AF.exe
2009-11-27 13:34 . 2009-11-27 13:34 40960 —-a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{ACB5EAD4-CD3E-428D-BACC-D9790AABE3AF}\ARPPRODUCTICON.exe
2009-11-27 13:30 . 2009-11-27 13:30 ——– d—–w- c:\program files\AMPED
2009-11-27 04:00 . 2009-11-27 04:00 ——– d—–w- c:\program files\BitTorrent
2009-10-27 04:57 . 2009-04-01 06:18 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-10-22 20:02 . 2009-03-31 06:07 98512 —-a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-30 16:31 . 2009-03-30 16:31 16384 –sha-w- c:\windows\keybd.dat
.

——- Sigcheck ——-

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll
[-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll

[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe
[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe

[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\system32\netman.dll
[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netman.dll

[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll
[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll

[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\system32\rpcss.dll
[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\rpcss.dll

[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\system32\services.exe
[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\services.exe

[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\spoolsv.exe
[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe

[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll
[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll

[-] 2004-08-04 12:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\system32\es.dll
[-] 2004-08-04 12:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\system32\dllcache\es.dll

[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll
[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll

[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\system32\kernel32.dll
[-] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\kernel32.dll

[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\linkinfo.dll
[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\linkinfo.dll

[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll
[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll

[-] 2009-08-29 . 0E49677EE57A928765FC47FFBACD5326 . 5940224 . . [8.00.6001.18828] . . c:\windows\system32\mshtml.dll
[-] 2009-08-29 . 0E49677EE57A928765FC47FFBACD5326 . 5940224 . . [8.00.6001.18828] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2009-08-29 . B68F6E6C66D17D9EDABF3D5DA71046DA . 5942272 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
[-] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB974455-IE8\mshtml.dll
[-] 2004-08-04 . 376E0843B2356CA91CEC8D9837A56FF7 . 3003392 . . [6.00.2900.2180] . . c:\windows\ie8\mshtml.dll

[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll

[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\system32\mswsock.dll
[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll
[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll

[-] 2004-08-04 . 626309040459C3915997EF98EC1C8D40 . 2148352 . . [5.1.2600.2180] . . c:\windows\system32\ntoskrnl.exe

[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll
[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll

[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll
[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll

[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll
[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll

[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe
[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe

[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\system32\tapisrv.dll
[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tapisrv.dll

[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\system32\user32.dll
[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\user32.dll

[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe
[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe

[-] 2009-08-29 . CF0A5FE05BF614C24950D8FAEC1BC309 . 916480 . . [8.00.6001.18828] . . c:\windows\system32\wininet.dll
[-] 2009-08-29 . CF0A5FE05BF614C24950D8FAEC1BC309 . 916480 . . [8.00.6001.18828] . . c:\windows\system32\dllcache\wininet.dll
[-] 2009-08-29 . 972B226BDAD71C55F3CC9A72BBF8F1C1 . 916480 . . [8.00.6001.22918] . . c:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[-] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB974455-IE8\wininet.dll
[-] 2004-08-04 . C0823FC5469663BA63E7DB88F9919D70 . 656384 . . [6.00.2900.2180] . . c:\windows\ie8\wininet.dll

[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll
[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll

[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\explorer.exe
[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\explorer.exe

[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll
[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe

[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll
[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll

[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll
[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll

[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll

[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe
[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe

[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll

[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll
[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll

[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll
[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll

[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll
[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll

[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll
[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll

[-] 2004-08-04 . 9C3C12975C97119412802B181FBEEFFE . 167936 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll
[-] 2004-08-04 . 9C3C12975C97119412802B181FBEEFFE . 167936 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll

[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2004-08-04 06:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\system32\dllcache\aec.sys
[-] 2004-08-04 06:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\system32\drivers\aec.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\system32\mfc40u.dll
[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\system32\dllcache\mfc40u.dll

[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll
[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll

[-] 2004-08-11 08:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-11 08:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\MsPMSNSv.dll
[-] 2004-08-11 08:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2004-08-04 12:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll

[-] 2004-08-04 . FB142B7007CA2EEA76966C6C5CC12150 . 2015232 . . [5.1.2600.2180] . . c:\windows\system32\ntkrnlpa.exe

[-] 2004-08-04 12:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll
[-] 2004-08-04 12:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll

[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll
[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-12-29_16.46.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-07 07:43 . 2010-01-07 07:43 16384 c:\windows\Temp\Perflib_Perfdata_c4c.dat
+ 2010-01-07 07:43 . 2010-01-07 07:43 16384 c:\windows\Temp\Perflib_Perfdata_670.dat
+ 2009-03-31 00:47 . 2010-01-07 07:15 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-03-31 00:47 . 2009-12-29 16:31 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-03-31 00:47 . 2010-01-07 07:15 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-31 00:47 . 2009-12-29 16:31 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-12-05 19:34 . 2010-01-07 07:15 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-12-05 19:34 . 2009-12-29 16:31 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-19 4363504]
"TBPanel"="c:\program files\Vtune\TBPanel.exe" [2008-12-19 2158592]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-12-17 2002160]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-09 13680640]
"nwiz"="nwiz.exe" [2009-01-09 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-09 86016]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-05 149280]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"globe"="c:\program files\Globe Telecom\Click Fix\bin\sprtcmd.exe" [2009-07-06 204672]

c:\documents and settings\user\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Monitor.lnk - c:\program files\USB Video Camera\Monitor.exe [2007-10-16 249856]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon]
2007-06-28 17:39 65536 —-a-w- c:\windows\system32\LogonDll.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /k:C *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1293:TCP"= 1293:TCP:stuma

R0 DeepFrz;DeepFrz;c:\windows\system32\drivers\DeepFrz.sys [6/28/2007 9:45 AM 131472]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [12/24/2009 8:03 PM 28552]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/20/2008 10:11 AM 33800]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12/16/2009 4:26 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/16/2009 4:26 PM 74480]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [12/21/2007 7:21 AM 468224]
R2 sprtsvc_globe;SupportSoft Sprocket Service (globe);c:\program files\Globe Telecom\Click Fix\bin\sprtsvc.exe [12/23/2009 4:10 PM 204672]
R2 tgsrvc_globe;SupportSoft Repair Service (globe);c:\program files\Globe Telecom\Click Fix\bin\tgsrvc.exe [12/23/2009 4:10 PM 151424]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/16/2009 4:27 PM 7408]
S3 AghAsh;AghAsh;\??\c:\documents and settings\user\Desktop\AghAsh.des –> c:\documents and settings\user\Desktop\AghAsh.des [?]
S3 AghHip;AghHip;\??\c:\documents and settings\user\Desktop\AghHip.des –> c:\documents and settings\user\Desktop\AghHip.des [?]
S3 Ca2001v;CA2001 WebCam Driver;c:\windows\system32\drivers\Ca2001v.sys [2/19/2008 10:48 AM 2333568]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 XDva288;XDva288;\??\c:\windows\system32\XDva288.sys –> c:\windows\system32\XDva288.sys [?]
S3 XDva300;XDva300;\??\c:\windows\system32\XDva300.sys –> c:\windows\system32\XDva300.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {D84EB4B0-BFA9-4B0C-B75A-17ABAD45ABB7} - hxxp://images.friendster.com/200911A-072/js/aurigma/FriendsterImageUploader.cab
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\dybn5c8q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=ytff-msgr&p;=
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src;=kw&tb;=BT3&o;=14979&locale;=en_US&q;=
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe
HKLM-Run-avgnt - c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
HKLM-Run-NeroFilterCheck - c:\program files\Common Files\Nero\Lib\NeroCheck.exe
AddRemove-Winamp - c:\program files\Winamp\UninstWA.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-06 23:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\AghAsh]
"ImagePath"="\??\c:\documents and settings\user\Desktop\AghAsh.des"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\AghHip]
"ImagePath"="\??\c:\documents and settings\user\Desktop\AghHip.des"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(712)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\LogonDll.dll
.
———————— Other Running Processes ————————
.
c:\program files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\windows\system32\mdm.exe
.
**************************************************************************
.
Completion time: 2010-01-06 23:49:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-07 07:49
ComboFix2.txt 2009-12-29 16:53

Pre-Run: 19,509,387,264 bytes free
Post-Run: 19,344,805,888 bytes free

- - End Of File - - 5692856DAA95304E2A1FD0381BF626E4

…..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:52 PM, on 1/6/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Globe Telecom\Click Fix\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Globe Telecom\Click Fix\bin\tgsrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Globe Telecom\Click Fix\bin\sprtcmd.exe
C:\Program Files\Vtune\TBPanel.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\USB Video Camera\Monitor.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [globe] C:\Program Files\Globe Telecom\Click Fix\bin\sprtcmd.exe /P globe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [TBPanel] C:\Program Files\Vtune\TBPanel.exe /A
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Monitor.lnk = C:\Program Files\USB Video Camera\Monitor.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1257100376578
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {D84EB4B0-BFA9-4B0C-B75A-17ABAD45ABB7} (Friendster Image Uploader Control) - http://images.friendster.com/200911A-072/j…ageUploader.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: SupportSoft Sprocket Service (globe) (sprtsvc_globe) - SupportSoft, Inc. - C:\Program Files\Globe Telecom\Click Fix\bin\sprtsvc.exe
O23 - Service: SupportSoft Repair Service (globe) (tgsrvc_globe) - SupportSoft, Inc. - C:\Program Files\Globe Telecom\Click Fix\bin\tgsrvc.exe
O23 - Service: Visual Studio Analyzer RPC bridge - Unknown owner - C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe (file missing)

–
End of file - 9196 bytes



…………………………………………..

as far for the performance of my PC..

sometimes it would go "SLOW"

and yes my nero's not working

and then just lately i've discovered that I cannot boot to safemode

and a blue screen will appear…

my superantispyware still goes to blue screen

and sometimes the audio of some of my applications is gone..

So far i activated my deepfreeze after every log to avoid minimum damage..

I never thought that my PC would get this much infections.
Post #9
Click Start > Run and Copy/Paste these commands hitting enter after each one:

sc stop AntiVirScheduler enter.

sc delete AntiVirScheduler Hit enter.


sc stop AntiVirService Hit enter.

sc delete AntiVirService Hit enter.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #10
i cant seem to find the link.. so i just run the update.. so far the superantispyware runs normal.. no blue screen and i tried booting to safe mode and no more blue screens.. I guess it's fixed.. Thank You.. :woot: One more thing… Am i clear of the rootkit?
Post #11
Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    To be on the safe side, I would also change all my passwords.


    Here's my usual all clean post

    Log looks good :D


    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      • From within Internet Explorer click on the Tools menu and then click on Options.
      • Click once on the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.


I would suggest you read How to Prevent Malware:
Post #12
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI