Spyware / Malware / Virus Removal

Cannot access Windows XP outside of safe mode

16 min read

Looking for the outcome? Ask AI

1rachaelm Topic Starter

Post #1July 9, 2010, 10:26 PM UTC

Please help!
At first I could not access the internet using internet explorer, but I could using Firefox, and now I can't access Windows except in safe mode. I downloaded OTL and followed your instructions. Here are the logs.
OTL logfile created on: 7/9/2010 5:09:03 PM - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\Rachael\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 759.00 Mb Available Physical Memory | 74.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 72.34 Gb Total Space | 51.26 Gb Free Space | 70.86% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DEFAULT-098E06D
Current User Name: Rachael
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Rachael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Rachael\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AfaService) – C:\WINDOWS\system32\afasrv32.exe ()
SRV - (MyWebSearchService) – C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE (MyWebSearch.com)
SRV - (avg8emc) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (lxcg_device) – C:\WINDOWS\System32\lxcgcoms.exe ( )
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (MHIKEY10) – C:\WINDOWS\system32\drivers\MHIKEY10.sys (Generic USB smartcard reader)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvatabus) – C:\WINDOWS\system32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nv_agp) – C:\WINDOWS\system32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php
IE - HKCU\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKCU\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\WINDOWS\Downloaded Program Files\tbhelper.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..browser.startup.homepage: "http://www.tattoodle.com?tid={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.1
FF - prefs.js..extensions.enabledItems: [removed]:10.3.85.0
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Zango\bin\10.3.85.0\firefox\extensions [2009/08/18 15:08:31 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MyWebSearch\bar\2.bin [2010/03/29 19:17:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/20 20:28:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/06 18:23:57 | 000,000,000 | —D | M]

[2009/04/19 21:06:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Mozilla\Extensions
[2010/05/02 12:34:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions
[2009/11/01 10:59:18 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/03 17:42:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}
[2010/04/28 20:04:18 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/05/27 13:13:30 | 000,070,408 | —- | M] (Zango, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npclntax_ZangoSA.dll
[2008/06/18 01:43:04 | 000,086,016 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/10/03 17:42:57 | 000,003,700 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.png
[2009/10/03 17:42:58 | 000,001,963 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.xml

O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (MyWebSearch Search Assistant BHO) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
O2 - BHO: (mwsBar BHO) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O2 - BHO: (ShoppingReport) - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (ShopperReports)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.85.0\HostIE.dll (Zango, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O2 - BHO: (Search Assistant) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll File not found
O2 - BHO: (XBTBPos00 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\WINDOWS\Downloaded Program Files\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKLM\..\Toolbar: (FaceFun) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\WINDOWS\Downloaded Program Files\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.85.0\HostIE.dll (Zango, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.85.0\HostIE.dll (Zango, Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [kjulfynx] C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe ()
O4 - HKLM..\Run: [LXCGCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.DLL ()
O4 - HKLM..\Run: [lxcgmon.exe] C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [USBestCR] C:\Program Files\USIM Editor\iconcs5139375.exe ()
O4 - HKLM..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.3.85.0\OEAddOn.exe (Zango, Inc.)
O4 - HKLM..\Run: [ZangoSA] C:\Program Files\Zango\bin\10.3.85.0\ZangoSA.exe (Zango, Inc.)
O4 - HKCU..\Run: [iLike] C:\Program Files\iLike\1.2.17\ilikesidebar.exe (iLike)
O4 - HKCU..\Run: [kjulfynx] C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe ()
O4 - HKCU..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKCU..\Run: [WeatherDPA] C:\Program Files\Zango\bin\10.3.85.0\Weather.exe (Zango, Inc.)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe (Adobe Systems, Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -Mozilla\4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident\4.0; File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (ShopperReports)
O9 - Extra Button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (ShopperReports)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {0CE0F418-1010-442D-871C-3454827DD539} http://www.facefun.com/FaceFun_webinstall/…Fun_product.cab (Reg Error: Key error.)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} http://static.ak.facebook.com/fbplugin/win…fbootloader.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1240194932609 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} https://ediagnostics.lexmark.com/serval.cab (Lexmark eDiagnostics Class)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Program Files\FunWebProducts\ScreenSaver\Images\f3wallpp.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Rachael\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/19 20:03:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O36 - AppCertDlls: AppSecDll - (C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server\bcryfj.dll) - C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server\bcryfj.dll File not found
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error starting restore point: The function was called in safe mode.
Error closing restore point: The sequence number is invalid.

========== Files/Folders - Created Within 30 Days ==========

[2010/07/09 17:07:39 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Rachael\Desktop\OTL.exe
[2010/07/09 16:47:38 | 000,000,000 | —D | C] – C:\WINDOWS\CSC
[2010/07/08 17:55:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu
[2010/07/08 17:54:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server
[2009/05/29 22:48:23 | 001,183,744 | —- | C] ( ) – C:\WINDOWS\System32\lxcgserv.dll
[2009/05/29 22:48:23 | 001,134,592 | —- | C] ( ) – C:\WINDOWS\System32\lxcgusb1.dll
[2009/05/29 22:48:23 | 000,155,648 | —- | C] ( ) – C:\WINDOWS\System32\lxcgprox.dll
[2009/05/29 22:48:23 | 000,114,688 | —- | C] ( ) – C:\WINDOWS\System32\lxcgpplc.dll
[2009/05/29 22:48:22 | 000,704,512 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomc.dll
[2009/05/29 22:48:22 | 000,483,328 | —- | C] ( ) – C:\WINDOWS\System32\lxcglmpm.dll
[2009/05/29 22:48:22 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomm.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/09 17:07:35 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Rachael\Desktop\OTL.exe
[2010/07/09 16:47:51 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/09 16:47:34 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/09 16:44:58 | 003,407,872 | —- | M] () – C:\Documents and Settings\Rachael\ntuser.dat
[2010/07/09 16:44:58 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Rachael\ntuser.ini
[2010/07/09 16:44:56 | 004,240,656 | -H– | M] () – C:\Documents and Settings\Rachael\Local Settings\Application Data\IconCache.db
[2010/07/09 12:31:00 | 000,000,426 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{1FDC5226-2B05-4DC6-B1FF-B20665AC6591}.job
[2010/07/09 12:30:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/09 12:30:00 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{6696834B-005D-4A5C-8C9E-5421B5B60F20}.job
[2010/07/09 12:25:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/07/09 12:05:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/07/09 09:45:59 | 061,788,923 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/09 08:30:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/04 04:24:00 | 000,000,448 | —- | M] () – C:\WINDOWS\tasks\Driver Robot.job
[2010/06/29 16:28:16 | 000,870,128 | —- | M] () – C:\Documents and Settings\Rachael\Application Data\mcs.rma
[2010/06/29 16:28:16 | 000,000,004 | —- | M] () – C:\Documents and Settings\Rachael\Application Data\78A677
[2010/06/29 16:17:49 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/25 13:38:09 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/23 03:02:49 | 000,500,732 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 03:02:49 | 000,440,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/23 03:02:49 | 000,071,002 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/28 17:30:39 | 000,000,286 | -H– | C] () – C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/06/28 17:30:33 | 000,000,286 | -H– | C] () – C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2009/05/29 23:40:12 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\hpzids01.dll
[2009/05/29 22:48:23 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxcgvs.dll
[2009/04/27 20:10:15 | 000,000,169 | —- | C] () – C:\WINDOWS\RtlRack.ini
[2009/04/19 21:32:11 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/04/19 21:24:48 | 000,000,164 | —- | C] () – C:\WINDOWS\avrack.ini
[2009/04/19 21:24:46 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll

========== LOP Check ==========

[2009/08/18 15:08:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
[2009/04/19 21:18:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2010/04/25 16:26:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2009/09/09 01:22:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ZangoSA
[2010/01/31 10:23:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Application Data
[2010/03/05 18:31:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Arkadium
[2009/07/20 17:22:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/03/03 18:43:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\cs
[2010/05/11 22:39:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Documents and Settings
[2010/05/18 20:27:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Facebook
[2010/04/06 20:19:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\FixCleaner
[2009/04/29 20:27:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\GetRightToGo
[2009/07/18 22:37:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\iLike
[2010/03/05 17:52:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Rachael
[2010/03/03 18:43:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\report
[2010/07/08 17:32:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\ShoppingReport
[2010/01/14 21:30:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Toolbar4
[2009/08/18 15:08:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\WeatherDPA
[2010/05/10 19:05:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Zango
[2010/07/04 04:24:00 | 000,000,448 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job
[2010/07/09 12:31:00 | 000,000,426 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{1FDC5226-2B05-4DC6-B1FF-B20665AC6591}.job
[2010/07/09 12:30:00 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{6696834B-005D-4A5C-8C9E-5421B5B60F20}.job
[2010/07/09 12:25:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/07/09 12:05:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2009/04/19 20:38:32 | 063,752,952 | —- | M] (AVG Technologies) – C:\avg_free_stf_en_85_287a1483.exe
[2009/04/19 20:58:04 | 007,518,920 | —- | M] (Mozilla) – C:\Firefox Setup 3.0.8.exe
[2009/06/21 18:23:54 | 000,306,960 | —- | M] (Zango, Inc.) – C:\Setup.exe

< MD5 for: AGP440.SYS >
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATABUS.SYS >
[2004/06/03 10:40:46 | 000,079,360 | —- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D – C:\Drivers\Motherboard Drivers\NVIDIA\nForceWin2KXP\5.10\IDE\Win2K\NvAtaBus.sys
[2004/06/03 10:40:46 | 000,079,360 | —- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D – C:\Drivers\Motherboard Drivers\NVIDIA\nForceWin2KXP\5.10\IDE\WinXP\NvAtaBus.sys
[2004/06/03 10:40:46 | 000,079,360 | —- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D – C:\WINDOWS\system32\drivers\nvatabus.sys

< MD5 for: SCECLI.DLL >
[2004/08/04 07:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/04/19 14:38:02 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/04/19 14:38:01 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/04/19 14:38:01 | 000,901,120 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< End of report >

OTL logfile created on: 7/9/2010 5:09:03 PM - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\Rachael\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 759.00 Mb Available Physical Memory | 74.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 72.34 Gb Total Space | 51.26 Gb Free Space | 70.86% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DEFAULT-098E06D
Current User Name: Rachael
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Rachael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Rachael\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AfaService) – C:\WINDOWS\system32\afasrv32.exe ()
SRV - (MyWebSearchService) – C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE (MyWebSearch.com)
SRV - (avg8emc) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (lxcg_device) – C:\WINDOWS\System32\lxcgcoms.exe ( )
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (MHIKEY10) – C:\WINDOWS\system32\drivers\MHIKEY10.sys (Generic USB smartcard reader)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvatabus) – C:\WINDOWS\system32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nv_agp) – C:\WINDOWS\system32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php
IE - HKCU\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKCU\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\WINDOWS\Downloaded Program Files\tbhelper.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..browser.startup.homepage: "http://www.tattoodle.com?tid={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.1
FF - prefs.js..extensions.enabledItems: [removed]:10.3.85.0
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Zango\bin\10.3.85.0\firefox\extensions [2009/08/18 15:08:31 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MyWebSearch\bar\2.bin [2010/03/29 19:17:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/20 20:28:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/06 18:23:57 | 000,000,000 | —D | M]

[2009/04/19 21:06:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Mozilla\Extensions
[2010/05/02 12:34:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions
[2009/11/01 10:59:18 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/03 17:42:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}
[2010/04/28 20:04:18 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/05/27 13:13:30 | 000,070,408 | —- | M] (Zango, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npclntax_ZangoSA.dll
[2008/06/18 01:43:04 | 000,086,016 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/10/03 17:42:57 | 000,003,700 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.png
[2009/10/03 17:42:58 | 000,001,963 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.xml

O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (MyWebSearch Search Assistant BHO) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
O2 - BHO: (mwsBar BHO) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O2 - BHO: (ShoppingReport) - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (ShopperReports)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.85.0\HostIE.dll (Zango, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O2 - BHO: (Search Assistant) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll File not found
O2 - BHO: (XBTBPos00 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\WINDOWS\Downloaded Program Files\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKLM\..\Toolbar: (FaceFun) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\WINDOWS\Downloaded Program Files\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.85.0\HostIE.dll (Zango, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.85.0\HostIE.dll (Zango, Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [kjulfynx] C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe ()
O4 - HKLM..\Run: [LXCGCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.DLL ()
O4 - HKLM..\Run: [lxcgmon.exe] C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [USBestCR] C:\Program Files\USIM Editor\iconcs5139375.exe ()
O4 - HKLM..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.3.85.0\OEAddOn.exe (Zango, Inc.)
O4 - HKLM..\Run: [ZangoSA] C:\Program Files\Zango\bin\10.3.85.0\ZangoSA.exe (Zango, Inc.)
O4 - HKCU..\Run: [iLike] C:\Program Files\iLike\1.2.17\ilikesidebar.exe (iLike)
O4 - HKCU..\Run: [kjulfynx] C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe ()
O4 - HKCU..\Run: [MyWebSearch Email Plugin] C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKCU..\Run: [WeatherDPA] C:\Program Files\Zango\bin\10.3.85.0\Weather.exe (Zango, Inc.)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe (Adobe Systems, Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -Mozilla\4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident\4.0; File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (ShopperReports)
O9 - Extra Button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (ShopperReports)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {0CE0F418-1010-442D-871C-3454827DD539} http://www.facefun.com/FaceFun_webinstall/…Fun_product.cab (Reg Error: Key error.)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} http://static.ak.facebook.com/fbplugin/win…fbootloader.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1240194932609 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} https://ediagnostics.lexmark.com/serval.cab (Lexmark eDiagnostics Class)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Program Files\FunWebProducts\ScreenSaver\Images\f3wallpp.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Rachael\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/19 20:03:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O36 - AppCertDlls: AppSecDll - (C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server\bcryfj.dll) - C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server\bcryfj.dll File not found
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error starting restore point: The function was called in safe mode.
Error closing restore point: The sequence number is invalid.

========== Files/Folders - Created Within 30 Days ==========

[2010/07/09 17:07:39 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Rachael\Desktop\OTL.exe
[2010/07/09 16:47:38 | 000,000,000 | —D | C] – C:\WINDOWS\CSC
[2010/07/08 17:55:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu
[2010/07/08 17:54:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server
[2009/05/29 22:48:23 | 001,183,744 | —- | C] ( ) – C:\WINDOWS\System32\lxcgserv.dll
[2009/05/29 22:48:23 | 001,134,592 | —- | C] ( ) – C:\WINDOWS\System32\lxcgusb1.dll
[2009/05/29 22:48:23 | 000,155,648 | —- | C] ( ) – C:\WINDOWS\System32\lxcgprox.dll
[2009/05/29 22:48:23 | 000,114,688 | —- | C] ( ) – C:\WINDOWS\System32\lxcgpplc.dll
[2009/05/29 22:48:22 | 000,704,512 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomc.dll
[2009/05/29 22:48:22 | 000,483,328 | —- | C] ( ) – C:\WINDOWS\System32\lxcglmpm.dll
[2009/05/29 22:48:22 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomm.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/09 17:07:35 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Rachael\Desktop\OTL.exe
[2010/07/09 16:47:51 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/09 16:47:34 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/09 16:44:58 | 003,407,872 | —- | M] () – C:\Documents and Settings\Rachael\ntuser.dat
[2010/07/09 16:44:58 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Rachael\ntuser.ini
[2010/07/09 16:44:56 | 004,240,656 | -H– | M] () – C:\Documents and Settings\Rachael\Local Settings\Application Data\IconCache.db
[2010/07/09 12:31:00 | 000,000,426 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{1FDC5226-2B05-4DC6-B1FF-B20665AC6591}.job
[2010/07/09 12:30:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/09 12:30:00 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{6696834B-005D-4A5C-8C9E-5421B5B60F20}.job
[2010/07/09 12:25:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/07/09 12:05:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/07/09 09:45:59 | 061,788,923 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/09 08:30:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/04 04:24:00 | 000,000,448 | —- | M] () – C:\WINDOWS\tasks\Driver Robot.job
[2010/06/29 16:28:16 | 000,870,128 | —- | M] () – C:\Documents and Settings\Rachael\Application Data\mcs.rma
[2010/06/29 16:28:16 | 000,000,004 | —- | M] () – C:\Documents and Settings\Rachael\Application Data\78A677
[2010/06/29 16:17:49 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/25 13:38:09 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/23 03:02:49 | 000,500,732 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 03:02:49 | 000,440,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/23 03:02:49 | 000,071,002 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/28 17:30:39 | 000,000,286 | -H– | C] () – C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/06/28 17:30:33 | 000,000,286 | -H– | C] () – C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2009/05/29 23:40:12 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\hpzids01.dll
[2009/05/29 22:48:23 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxcgvs.dll
[2009/04/27 20:10:15 | 000,000,169 | —- | C] () – C:\WINDOWS\RtlRack.ini
[2009/04/19 21:32:11 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/04/19 21:24:48 | 000,000,164 | —- | C] () – C:\WINDOWS\avrack.ini
[2009/04/19 21:24:46 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll

========== LOP Check ==========

[2009/08/18 15:08:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
[2009/04/19 21:18:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2010/04/25 16:26:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2009/09/09 01:22:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ZangoSA
[2010/01/31 10:23:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Application Data
[2010/03/05 18:31:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Arkadium
[2009/07/20 17:22:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/03/03 18:43:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\cs
[2010/05/11 22:39:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Documents and Settings
[2010/05/18 20:27:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Facebook
[2010/04/06 20:19:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\FixCleaner
[2009/04/29 20:27:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\GetRightToGo
[2009/07/18 22:37:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\iLike
[2010/03/05 17:52:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Rachael
[2010/03/03 18:43:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\report
[2010/07/08 17:32:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\ShoppingReport
[2010/01/14 21:30:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Toolbar4
[2009/08/18 15:08:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\WeatherDPA
[2010/05/10 19:05:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Zango
[2010/07/04 04:24:00 | 000,000,448 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job
[2010/07/09 12:31:00 | 000,000,426 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{1FDC5226-2B05-4DC6-B1FF-B20665AC6591}.job
[2010/07/09 12:30:00 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{6696834B-005D-4A5C-8C9E-5421B5B60F20}.job
[2010/07/09 12:25:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/07/09 12:05:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2009/04/19 20:38:32 | 063,752,952 | —- | M] (AVG Technologies) – C:\avg_free_stf_en_85_287a1483.exe
[2009/04/19 20:58:04 | 007,518,920 | —- | M] (Mozilla) – C:\Firefox Setup 3.0.8.exe
[2009/06/21 18:23:54 | 000,306,960 | —- | M] (Zango, Inc.) – C:\Setup.exe

< MD5 for: AGP440.SYS >
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009/06/06 17:52:22 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 07:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 07:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATABUS.SYS >
[2004/06/03 10:40:46 | 000,079,360 | —- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D – C:\Drivers\Motherboard Drivers\NVIDIA\nForceWin2KXP\5.10\IDE\Win2K\NvAtaBus.sys
[2004/06/03 10:40:46 | 000,079,360 | —- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D – C:\Drivers\Motherboard Drivers\NVIDIA\nForceWin2KXP\5.10\IDE\WinXP\NvAtaBus.sys
[2004/06/03 10:40:46 | 000,079,360 | —- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D – C:\WINDOWS\system32\drivers\nvatabus.sys

< MD5 for: SCECLI.DLL >
[2004/08/04 07:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/04/19 14:38:02 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/04/19 14:38:01 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/04/19 14:38:01 | 000,901,120 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< End of report >

I also ran an AVG Free Scan from safe mode earlier. Here is that log.

AVG 8.5 Anti-Virus command line scanner
Copyright © 1992 - 2009 AVG Technologies
Program version 8.0.431, engine 8.0.440
Virus Database: Version 271.1.1/2991 2010-07-09

C:\Documents and Settings\Justin\Application Data\38500b0e.exe Trojan horse FakeAV.CDD
C:\Documents and Settings\Justin\Local Settings\Application Data\syssvc.exe Trojan horse Generic17.BJND
C:\Documents and Settings\Justin\Local Settings\Application Data\xcjvfbrtp\pjaqngttssd.exe Trojan horse Generic18.TXN
C:\Documents and Settings\Justin\Local Settings\Temp\Lxj.exe Trojan horse FakeAV.CDD
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Rachael\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\Rachael\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Rachael\ntuser.dat Locked file. Not tested.
C:\Documents and Settings\Rachael\NTUSER.DAT.LOG Locked file. Not tested.
C:\pagefile.sys Locked file. Not tested.
C:\Program Files\Fast Browser Search\IE\BHO.dll Adware Generic4.RRA
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1003\Dc102\RiskIISetup-dm[1].exe Adware Generic4.ACKW
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1003\Dc102\RollerCoasterTycoon2-dm[1].exe Adware Generic4.ACKW
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1003\Dc17\BHO.dll Adware Generic4.RRA
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1008\Dc3.exe Trojan horse Cryptic.AJX
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1008\Dc4.exe Trojan horse Cryptic.AJX
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1008\Dc5.exe Trojan horse Generic18.TXN
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1008\Dc8.exe Trojan horse Generic17.BIMA
C:\RECYCLER\S-1-5-21-1454471165-630328440-682003330-1008\Dc9.exe Trojan horse Generic17.BIMA
C:\System Volume Information\ Locked file. Not tested.
C:\WINDOWS\system32\config\default Locked file. Not tested.
C:\WINDOWS\system32\config\default.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SAM Locked file. Not tested.
C:\WINDOWS\system32\config\SAM.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\software Locked file. Not tested.
C:\WINDOWS\system32\config\software.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\system Locked file. Not tested.
C:\WINDOWS\system32\config\system.LOG Locked file. Not tested.

————————————————————
Objects scanned : 198784
Found infections : 9
Found PUPs : 4
Healed infections : 0
Healed PUPs : 0
Warnings : 0
————————————————————

Attachments:

SweetTech

Post #2July 10, 2010, 12:26 AM UTC

Hello,

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 3 days) and you need an explanation. If that's the case, just send me a message to me on here.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

OTL Fix

We need to run an OTL Fix

Please reopen [external image: Posted Image] on your desktop.

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:Services
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Assistant) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll File not found
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [kjulfynx] C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe ()
O4 - HKLM..\Run: [USBestCR] C:\Program Files\USIM Editor\iconcs5139375.exe ()
O4 - HKCU..\Run: [kjulfynx] C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe ()
O16 - DPF: {0CE0F418-1010-442D-871C-3454827DD539} http://www.facefun.com/FaceFun_webinstall/…Fun_product.cab (Reg Error: Key error.)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} http://static.ak.facebook.com/fbplugin/win…fbootloader.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O36 - AppCertDlls: AppSecDll - (C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server\bcryfj.dll) - C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server\bcryfj.dll File not found
[2010/07/08 17:55:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu
[2010/07/08 17:54:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server
[2010/07/09 12:25:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/07/09 12:05:00 | 000,000,286 | -H– | M] () – C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that is produced after running the OTL Fix.
3. The log that is produced after running the ComboFix scan.
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

1rachaelm

Post #3July 10, 2010, 12:51 AM UTC

Thank you so much for helping me-here goes All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0626A63-410B-45E2-99A1-3F2475B2D695}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\kjulfynx deleted successfully. C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\USBestCR deleted successfully. C:\Program Files\USIM Editor\iconcs5139375.exe moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\kjulfynx deleted successfully. File C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe not found. Starting removal of ActiveX control {0CE0F418-1010-442D-871C-3454827DD539} C:\WINDOWS\Downloaded Program Files\tbcore3.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0CE0F418-1010-442D-871C-3454827DD539}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CE0F418-1010-442D-871C-3454827DD539}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0CE0F418-1010-442D-871C-3454827DD539}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CE0F418-1010-442D-871C-3454827DD539}\ not found. Starting removal of ActiveX control {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.1.1.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ not found. Starting removal of ActiveX control {32C3FEAE-0877-4767-8C20-62A5829A0945} C:\WINDOWS\Downloaded Program Files\axfbootloader.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\ not found. Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} C:\WINDOWS\Downloaded Program Files\erma.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\AppSecDll:C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server\bcryfj.dll deleted successfully. C:\Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu folder moved successfully. C:\Documents and Settings\Rachael\Local Settings\Application Data\Windows Server folder moved successfully. C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job moved successfully. C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Application Data User: cs User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Documents and Settings User: Justin ->Temp folder emptied: 756248232 bytes ->Temporary Internet Files folder emptied: 57328129 bytes ->Java cache emptied: 148499 bytes ->FireFox cache emptied: 95634079 bytes ->Flash cache emptied: 172893 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 8852590 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33237 bytes User: Rachael ->Temp folder emptied: 239366759 bytes ->Temporary Internet Files folder emptied: 179148681 bytes ->Java cache emptied: 10043852 bytes ->FireFox cache emptied: 102661750 bytes ->Flash cache emptied: 212901 bytes User: report User: ShoppingReport %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2162283 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 66380678 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 64188592 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 2585151680 bytes Total Files Cleaned = 3,975.00 mb [EMPTYFLASH] User: All Users User: Application Data User: cs User: Default User User: Documents and Settings User: Justin ->Flash cache emptied: 0 bytes User: LocalService User: NetworkService User: Rachael ->Flash cache emptied: 0 bytes User: report User: ShoppingReport Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.8.1 log created on 07092010_193935

SweetTech

Post #4July 10, 2010, 12:58 AM UTC

1rachaelm

Post #5July 10, 2010, 1:32 AM UTC

This seems to have fixed my machine…Combofix log

ComboFix 10-07-08.02 - Rachael 07/09/2010 20:08:11.1.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.824 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\documents and settings\All Users\Application Data\ZangoSA
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSA.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAau.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAEULA.mht
c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk
c:\documents and settings\Justin\Application Data\38500b0e.exe
c:\documents and settings\Justin\Application Data\ShoppingReport
c:\documents and settings\Justin\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Justin\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\Justin\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\Justin\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\Justin\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\Justin\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\Justin\Application Data\ShoppingReport\cs\res2(2)\WhiteList.dbs
c:\documents and settings\Justin\Application Data\Zango
c:\documents and settings\Justin\Application Data\Zango\eskin\040107ta294_arrow.ani
c:\documents and settings\Justin\Application Data\Zango\eskin\040107ta294_cr.htm
c:\documents and settings\Justin\Application Data\Zango\eskin\040107ta294_prv.gif
c:\documents and settings\Justin\Application Data\Zango\eskin\FileManager.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte10_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte11_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte12_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte13_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte14_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte19_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte20_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte21_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030104_emte9_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\030203lib_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102angel_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102bigluf_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102bigsmile_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102birthday_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102cheers_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102flo_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102good_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102jump_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102king_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102lough_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102luf_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102smile_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102smiled_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102sor_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102thanx_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\033102uhu_1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\040103ahh_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\040103wow_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\040104_emi2_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\042102_1134_112_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\050103big_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\050103gig_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\050103hm_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\050103nomail_emoti_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\050103norm_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema15_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema16_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema17_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema18_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema19_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema20_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema21_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema24_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema25_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema26_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema30_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema33_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\060104_ema34_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\062802hippi_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\062802jumpie_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\080402argh_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\080402oops_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\080402ouch_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\082502no_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\082502yes_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_boring1_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_confused_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_crying_ugly_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_fantastic_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_feel_better_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_gimme_break_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_heehee_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_hlopaet_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_ign_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_lol_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_no_comment_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_peace_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_smashing_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\110103_talk2thehand_prv.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\avatar.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\block_sm.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\block_sm2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\block_smli.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\block_smli2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\blocked.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\blocked2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_add-but.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_back-but.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_left_cut_enabled_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_left_enabled_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_left_pressed_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_middle_enabled_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_middle_pressed_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_right_cut_enabled_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_right_enabled_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\btn_right_pressed_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\business_promo.htm
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\buttondir.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\components.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\css_cattree.css
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\css_flashpreview.css
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\css2_main.css
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\css2_pagingmodule.css
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\css2_topbuttons.css
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\cursors.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\delete.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\edit_clear_sound.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\edit_fs.htm
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\edit_select.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-543450.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-548964.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-589306.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-591943.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-592579.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-598579.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-603763.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-9595.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511724-9696.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-511745-514279.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-backgrounds.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-bcards.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-ecards.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-emoticons.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-estationery.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-funny.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-help.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-images.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-info.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-more.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-my.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-new.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-new2.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-options.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-people.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-photo.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-tell.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-temp.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-text.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def-email-voice.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-def.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-premium-email-premium.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-t1-bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\email-temp-bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\estatationery.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\flashpatch.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\flashpreview.htm
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\fs3.htm
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\hotbar_promo.htm
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_checked_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_close_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_close_pressed_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_edit_preview.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_edit_send.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_flash_preview.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_recently_used.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_remove_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_remove_pressed_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_sand-clock2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_tell_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_tell_pressed_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_tree_null.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_unchecked_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\icon_unchecked_pressed_1.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\img_barlayout.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\img_barlayout2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\img_barlayout4.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\img_corner_left.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\img_local_logo.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_basetemplate.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_hbgroups.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_hbobject3.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_hbobjectset3.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_hotbarwrapper.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_iteratorsandreaders3nf.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_pagingmoduleobj3.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_texts3.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\js2_xmltree3nf.js
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\layout.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\linkpathlegal.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\n.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\nav_b_2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\nav_bb_2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\nav_f_2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\nav_ff_2.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\pro_hb_fo_word.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\progress.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\sales_buttons.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\searchbtn.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\submit.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_bg.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_bga.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_bgia.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_l.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_la.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_lia.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_r.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_ra.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tab_ria.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tree_dots.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tree_minus.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\tree_plus.gif
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\treedata_animations.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\treedata_backgrounds.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\treedata_ecards.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\treedata_emoticons.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\treedata_notifiers.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\treedata_text.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\HostOL\static\1\zango_btn.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1055669.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1057468.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1059014.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1059350.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1063425.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1064992.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1065150.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1067536.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1070524.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1070542.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\114838.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1212145.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1385437.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1385449.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1385459.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1385760.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1385843.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1386779.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1389202.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1389322.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1389783.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1390558.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1393673.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1394249.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1395668.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1395704.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1398476.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1399676.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1402008.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1405661.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1408056.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\151198.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\164959.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\177265.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\179653.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\180552.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\18255.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\1838672.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\192145.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2094486.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2214444.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\221540.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2221934.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2438469.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\268841.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2830927.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2884290.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2901993.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2903617.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\2904107.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3250809.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3309148.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3340633.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3340762.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3385108.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3404705.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3421532.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3425831.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3426569.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3467152.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3469510.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\370323.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3707170.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3713587.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3730773.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3756201.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3756256.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3781281.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\381556.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3852810.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3855249.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3858141.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3893164.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3893169.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3893175.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3894034.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3894050.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3894093.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3894096.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3894099.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3894100.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3895003.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\3895584.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\441982.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\48657.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\527622.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\550803.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\57450.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\575671.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\600583.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\602525.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\625696.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\647388.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\731481.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\737654.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\775501.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\801700.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\803901.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\819382.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\847519.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\866454.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\868678.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\928488.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\948597.sdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\domains.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000027221
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000029935
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000030162
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000030338
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000030581
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000030985
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000031843
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000041060
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000044868
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000047768
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000047858
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000048356
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000048602
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000067581
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000067669
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000067768
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\10052
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\104622
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1058
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\10685
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\10692
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\10807
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\10915
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\11213
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\11312
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\116250
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\11891
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\119945
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\12078
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\12312
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\12435
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\126694
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\13119
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\134210
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\13608
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\13939
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\14083
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1410
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1411
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\141880
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\14437
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1450
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\146284
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1489
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1491
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\15162
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\15473
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\15535
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\15541
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\156814
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\15743
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\159328
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16087
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16173
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16176
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\161965
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16197
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16210
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16211
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\167151
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16841
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\17025
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\17063
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\173081
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\180320
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\18035
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\18779
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\18906
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\19052
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\191116
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\193255
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\194105
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\19624
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\19650
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\198406
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\199881
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20106
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20119
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20128
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\202699
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20299
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20304
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20478
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\205556
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20570
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20898
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\210198
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\21060
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\211386
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\212398
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\213355
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\216168
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\218682
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\218712
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\218859
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\219011
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\22000
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\22231
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\22254
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\22257
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\223385
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\22458
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\23022
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\230333
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\23147
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\233324
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\235796
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\23607
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\23889
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\23923
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\24098
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\242317
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\243256
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\24362
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\24483
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\2498
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25032
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\251440
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25226
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\252531
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25469
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25502
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25509
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25708
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25869
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25911
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\259172
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26125
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\261991
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26272
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26335
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26340
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\264153
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\264564
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26479
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26656
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26664
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26739
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26743
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26763
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26764
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\268125
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26821
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26839
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26869
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\27414
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\27503
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\27505
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\27533
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\275654
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\275967
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\276864
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\278243
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\278975
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\28026
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\281638
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\284928
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\288733
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\289716
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\290893
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\29115
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\29135
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\29642
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\297534
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\297598
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\300893
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\302699
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\303265
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\3048
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\308876
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\30920
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\30999
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31196
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31262
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31276
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31302
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\313470
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31387
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31463
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31537
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31551
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31690
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31828
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31979
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32122
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32137
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32171
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32290
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32326
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32634
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32722
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33069
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33110
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33137
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33233
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33697
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34123
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34167
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34186
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34237
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\342421
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34267
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34374
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\345676
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\348760
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34947
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34952
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35006
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35015
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35017
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\350397
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35047
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35062
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35120
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35410
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35463
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35554
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\356660
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35804
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35865
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\361427
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\367116
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\367353
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\36834
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\37071
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\37258
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\374830
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\37602
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\3796
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\37999
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\385728
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\38631
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\38733
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\388251
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\389083
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39228
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39245
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39479
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39632
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39850
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\39947
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\399727
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\401109
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40245
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40256
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40260
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40726
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40766
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4088
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40999
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41215
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41341
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41364
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4142
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41526
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41528
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41558
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41561
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41581
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\41999
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42013
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42208
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42351
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\423530
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42425
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42491
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\427075
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\427148
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42861
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43118
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43120
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\431374
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\435639
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43719
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43979
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44228
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44293
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44306
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44313
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44458
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44529
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44595
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44789
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44878
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44882
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449274
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449624
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449742
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\453218
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45351
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45364
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45437
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45462
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45510
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\456216
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\45833
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\460010
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\46021
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\460458
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\462385
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\46283
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4670
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\46705
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\471072
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4721
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\472967
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\47370
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\47468
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4765
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\476910
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\477109
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\477253
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\47891
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4822
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\482360
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\486362
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\486568
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\489760
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4899
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\490332
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50228
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50578
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\507892
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50887
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50905
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50939
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51194
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\51880
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\519215
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52335
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\526389
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\526507
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\526532
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\528311
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\528757
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52902
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52968
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52972
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52974
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52977
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\531510
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\532492
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\53481
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\53501
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\53595
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\539163
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\53923
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\539752
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54161
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54469
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\545986
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\547723
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\548168
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54867
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54888
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\549635
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\5508
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\552031
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\552212
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\556604
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\55661
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\55725
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\559580
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\561071
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\564073
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\56412
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\564375
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\567442
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\56815
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\568672
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\569859
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\572769
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\577419
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\5777
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\577929
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\578081
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\578140
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\578150
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\578458
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57904
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\579123
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\57942
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\580792
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\580864
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58203
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58307
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58336
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\586331
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\5867
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58804
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59137
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59196
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\591963
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\592018
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\592045
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\592059
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\592060
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59221
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59231
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59243
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59288
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59844
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59872
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59913
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\604347
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61455
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\614613
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\617132
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61779
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61837
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\61951
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\62070
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\622354
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\627072
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\628146
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6292
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\63232
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\63684
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\63770
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64364
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64402
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64424
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64495
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64605
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64646
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64675
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64690
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64928
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64972
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\650494
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\65429
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6558
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6559
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\65770
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\65782
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\65843
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66109
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66137
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66264
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66274
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66493
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66498
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66836
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66851
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67075
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67215
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67226
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67345
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67464
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67466
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67481
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67564
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67733
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67933
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68016
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68040
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68041
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68051
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68055
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68076
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68098
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68257
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68569
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\68838
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6915
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69156
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69199
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69263
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69325
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69556
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69588
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69625
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69626
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70375
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70773
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\70907
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71175
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\711791
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71531
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71600
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71999
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72072
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72123
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72748
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\727608
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72842
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\72889
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7295
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73282
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73301
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73458
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73576
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737665
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737949
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738185
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738417
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738455
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73905
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\743543
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744279
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744513
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744599
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744793
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744837
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744864
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744869
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744930
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744977
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744984
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745029
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745064
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745088
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745136
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745138
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745144
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745146
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745175
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745201
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745220
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745263
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745415
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745433
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745472
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745500
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745643
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\74576
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745838
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745992
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\746529
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\74777
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\747928
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\747936
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\74798
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748002
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748176
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748330
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748352
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748397
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748405
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748880
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\749354
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\750039
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\75013
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\75042
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\75045
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\750800
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\75098
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751033
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751209
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751223
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751751
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7518
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7521
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\752499
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\75250
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\752626
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753036
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753044
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753194
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753197
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753198
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753199
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753224
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753230
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753250
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753300
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753321
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753366
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753374
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753437
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753438
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753446
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753590
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753618
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753619
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753621
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753622
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753627
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753628
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753632
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753634
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753635
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\75834
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\77468
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\78237
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\78600
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7887
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79079
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79141
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79246
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79257
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79264
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79432
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79560
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79683
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79721
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79819
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79977
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\800
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80061
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80193
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80374
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80663
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80670
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81293
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81392
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81504
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81507
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81830
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82098
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82155
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82292
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82442
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82511
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82557
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82594
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82633
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\8290
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\83139
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\83216
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\83226
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\83463
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\83706
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\8395
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\8438
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\8443
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\84449
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\84876
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85055
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85062
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85083
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85182
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85193
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85205
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85381
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85522
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85568
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85698
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86140
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86173
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86460
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86654
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87151
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\873
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87387
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\87579
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\88183
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\88533
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\88578
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89211
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89658
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89925
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89936
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90009
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90128
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90154
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90195
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90358
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90361
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90819
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\91204
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\91224
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\91300
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\91986
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\92061
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\92930
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93110
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93113
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93192
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93226
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93295
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\9332
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93845
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93899
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93916
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93921
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93934
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93997
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\94120
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\94407
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\94844
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95701
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95704
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95716
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95740
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95774
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95798
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95803
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95825
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95849
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95855
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95917
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\9672
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97499
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97524
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97666
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97734
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97741
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97964
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\9805
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98248
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98250
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98325
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98395
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98677
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\99163
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\9974
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\99742
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\99795
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\avatar.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\btntrans.idx
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\btntrans1.dat
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\buttondir.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\components.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\cursors.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_1000.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_2000.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_3000.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bar.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bbar1.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_logos.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_other.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\d_icons_weather.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\default.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_511745-514279.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-ca.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-us.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_categorize.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_comparison.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-Mails.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-people.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_favorites.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_Games.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_Hide.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_hotbarcom.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_Hotmail.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_hsskin.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_jemster.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_jemsterie.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_jemsteruk.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_jobsearch.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_Mails.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_MobileSidewalk.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_new.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_premium.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_reun.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_ringtones.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_SearchBoxTrapper.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_searchfor.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_searchgo.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_weather.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Default_yellowpages.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\editblbuttons.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-548964.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-9595.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\email-t1-bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\icons2.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\ie_games_icon.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\ie_video.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\keywords.idx
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\keywords1.dat
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\layout.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\linkpathlegal.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\progress.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\s_icons_buttons.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\sales_buttons.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\sdfmodifier.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\t2_bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\theweb.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\top7.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\Top7_theweb.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\tsd_bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\zango_btn.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\1\zango_ie_menu.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\avatar.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\btntrans.idx
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\btntrans1.dat
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\buttondir.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\components.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\cursors.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_1000.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_2000.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_3000.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bar.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bbar1.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_logos.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_other.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\d_icons_weather.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\default.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_511745-514279.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-ca.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-us.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_categorize.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_comparison.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-Mails.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-people.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_favorites.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_Games.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_Hide.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_hotbarcom.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_Hotmail.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_hsskin.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_jemster.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_jemsterie.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_jemsteruk.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_jobsearch.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_Mails.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_MobileSidewalk.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_new.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_premium.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_reun.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_ringtones.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_SearchBoxTrapper.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_searchfor.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_searchgo.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_weather.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Default_yellowpages.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\editblbuttons.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-548964.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-9595.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\email-t1-bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\icons2.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\ie_games_icon.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\ie_video.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\keywords.idx
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\keywords1.dat
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\layout.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\linkpathlegal.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\progress.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\s_icons_buttons.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\sales_buttons.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\sdfmodifier.xml
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\t2_bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\theweb.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\top7.cdf
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\Top7_theweb.mnu
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\tsd_bg.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\zango_btn.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\2\zango_ie_menu.res
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\avatar.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans1.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\buttondir.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\cursors.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_1000.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_2000.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_3000.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bar.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bbar1.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_logos.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_other.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_weather.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\default.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\editblbuttons.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\email-t1-bg.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\icons2.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_games_icon.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_video.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords1.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\layout.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\linkpathlegal.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\progress.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\s_icons_buttons.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\sales_buttons.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\sdfmodifier.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\t2_bg.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\top7.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\tsd_bg.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_btn.xip
c:\documents and settings\Justin\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_ie_menu.xip
c:\documents and settings\Justin\Local Settings\Application Data\syssvc.exe
c:\documents and settings\Justin\Local Settings\Application Data\xcjvfbrtp
c:\documents and settings\Justin\Local Settings\Application Data\xcjvfbrtp\pjaqngttssd.exe
c:\documents and settings\Rachael\Application Data\ShoppingReport
c:\documents and settings\Rachael\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Rachael\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\Rachael\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\Rachael\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\Rachael\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\Rachael\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\Rachael\Application Data\WeatherDPA
c:\documents and settings\Rachael\Application Data\WeatherDPA\Weather\WeatherStartup.xml
c:\documents and settings\Rachael\Application Data\Zango
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte10_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte11_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte12_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte13_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte14_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte19_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte20_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte21_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030104_emte9_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\030203lib_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102angel_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102bigluf_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102bigsmile_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102birthday_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102cheers_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102flo_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102good_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102jump_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102king_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102lough_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102luf_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102smile_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102smiled_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102sor_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102thanx_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\033102uhu_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\040103ahh_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\040103wow_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\040104_emi2_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\042102_1134_112_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\050103big_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\050103gig_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\050103hm_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\050103nomail_emoti_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\050103norm_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema15_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema16_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema17_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema18_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema19_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema20_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema21_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema24_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema25_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema26_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema30_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema33_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\060104_ema34_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\062802hippi_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\062802jumpie_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\080402argh_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\080402oops_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\080402ouch_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\082502no_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\082502yes_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_boring1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_confused_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_crying_ugly_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_fantastic_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_feel_better_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_gimme_break_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_heehee_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_hlopaet_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_ign_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_lol_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_no_comment_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_peace_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_smashing_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\110103_talk2thehand_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\avatar.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\block_sm.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\block_sm2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\block_smli.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\block_smli2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\blocked.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\blocked2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_add-but.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_back-but.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_left_cut_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_left_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_left_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_middle_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_middle_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_right_cut_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_right_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\btn_right_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\business_promo.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\buttondir.txt
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\components.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\css_cattree.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\css_flashpreview.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\css2_main.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\css2_pagingmodule.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\css2_topbuttons.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\cursors.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\delete.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\edit_clear_sound.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\edit_fs.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\edit_select.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\email-t1-bg.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\email-temp-bg.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\estatationery.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\flashpatch.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\flashpreview.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\fs3.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\hotbar_promo.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_checked_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_close_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_close_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_edit_preview.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_edit_send.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_flash_preview.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_recently_used.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_remove_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_remove_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_sand-clock2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_tell_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_tell_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_tree_null.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_unchecked_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\icon_unchecked_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\img_barlayout.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\img_barlayout2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\img_barlayout4.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\img_corner_left.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\img_local_logo.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_basetemplate.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_hbgroups.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_hbobject3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_hbobjectset3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_hotbarwrapper.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_iteratorsandreaders3nf.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_pagingmoduleobj3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_texts3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\js2_xmltree3nf.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\layout.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\linkpathlegal.txt
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\n.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\nav_b_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\nav_bb_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\nav_f_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\nav_ff_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\progress.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\sales_buttons.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\searchbtn.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\submit.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_bg.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_bga.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_bgia.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_l.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_la.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_lia.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_r.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_ra.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tab_ria.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tree_dots.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tree_minus.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\tree_plus.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\treedata_animations.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\treedata_backgrounds.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\treedata_ecards.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\treedata_emoticons.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\treedata_notifiers.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\treedata_text.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\1\zango_btn.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte10_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte11_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte12_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte13_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte14_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte19_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte20_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte21_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030104_emte9_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\030203lib_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102angel_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102bigluf_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102bigsmile_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102birthday_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102cheers_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102flo_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102good_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102jump_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102king_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102lough_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102luf_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102smile_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102smiled_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102sor_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102thanx_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\033102uhu_1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\040103ahh_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\040103wow_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\040104_emi2_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\042102_1134_112_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\050103big_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\050103gig_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\050103hm_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\050103nomail_emoti_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\050103norm_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema15_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema16_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema17_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema18_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema19_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema20_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema21_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema24_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema25_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema26_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema30_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema33_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\060104_ema34_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\062802hippi_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\062802jumpie_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\080402argh_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\080402oops_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\080402ouch_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\082502no_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\082502yes_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_boring1_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_confused_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_crying_ugly_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_fantastic_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_feel_better_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_gimme_break_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_heehee_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_hlopaet_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_ign_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_lol_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_no_comment_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_peace_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_smashing_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\110103_talk2thehand_prv.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\avatar.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\block_sm.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\block_sm2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\block_smli.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\block_smli2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\blocked.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\blocked2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_add-but.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_back-but.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_left_cut_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_left_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_left_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_middle_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_middle_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_right_cut_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_right_enabled_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\btn_right_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\business_promo.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\buttondir.txt
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\components.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\css_cattree.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\css_flashpreview.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\css2_main.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\css2_pagingmodule.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\css2_topbuttons.css
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\cursors.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\delete.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\edit_clear_sound.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\edit_fs.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\edit_select.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\email-t1-bg.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\email-temp-bg.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\estatationery.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\flashpatch.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\flashpreview.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\fs3.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\hotbar_promo.htm
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_checked_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_close_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_close_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_edit_preview.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_edit_send.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_flash_preview.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_recently_used.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_remove_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_remove_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_sand-clock2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_tell_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_tell_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_tree_null.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_unchecked_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\icon_unchecked_pressed_1.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\img_barlayout.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\img_barlayout2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\img_barlayout4.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\img_corner_left.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\img_local_logo.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_basetemplate.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_hbgroups.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_hbobject3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_hbobjectset3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_hotbarwrapper.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_iteratorsandreaders3nf.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_pagingmoduleobj3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_texts3.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\js2_xmltree3nf.js
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\layout.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\linkpathlegal.txt
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\n.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\nav_b_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\nav_bb_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\nav_f_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\nav_ff_2.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\progress.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\sales_buttons.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\searchbtn.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\submit.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_bg.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_bga.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_bgia.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_l.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_la.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_lia.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_r.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_ra.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tab_ria.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tree_dots.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tree_minus.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\tree_plus.gif
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\treedata_animations.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\treedata_backgrounds.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\treedata_ecards.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\treedata_emoticons.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\treedata_notifiers.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\treedata_text.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\2\zango_btn.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\avatar.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\business_promo.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\buttondir.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\code.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\cursors.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\email-t1-bg.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\email-temp-bg.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\hotbar_promo.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\images.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\layout.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\linkpathlegal.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\localcontent.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\progress.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\sales_buttons.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\treexml.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\HostOI\static\DownLoad\zango_btn.xip
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\avatar.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\btntrans.idx
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\btntrans1.dat
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\buttondir.txt
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\components.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\cursors.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_1000.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_2000.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_3000.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bar.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bbar1.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_logos.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_other.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\d_icons_weather.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\default.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_511745-514279.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-ca.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-us.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_categorize.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_comparison.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-Mails.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-people.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_favorites.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_Games.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_Hide.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_hotbarcom.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_Hotmail.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_hsskin.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_jemster.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_jemsterie.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_jemsteruk.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_jobsearch.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_Mails.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_MobileSidewalk.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_new.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_premium.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_reun.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_ringtones.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_SearchBoxTrapper.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_searchfor.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_searchgo.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_weather.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Default_yellowpages.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\editblbuttons.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-548964.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-9595.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\email-t1-bg.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\icons2.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\ie_games_icon.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\ie_video.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\keywords.idx
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\keywords1.dat
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\layout.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\linkpathlegal.txt
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\progress.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\s_icons_buttons.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\sales_buttons.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\sdfmodifier.xml
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\t2_bg.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\theweb.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\top7.cdf
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\Top7_theweb.mnu
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\tsd_bg.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\zango_btn.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\1\zango_ie_menu.res
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt
c:\documents and settings\Rachael\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip
c:\program files\Downloaded Installers
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Cache\005418DE.jpg
c:\program files\FunWebProducts\ScreenSaver\Cache\00BD9A64
c:\program files\FunWebProducts\ScreenSaver\Cache\files.ini
c:\program files\FunWebProducts\ScreenSaver\Images\005C667A.dat
c:\program files\FunWebProducts\ScreenSaver\Images\00BBF762.urr
c:\program files\FunWebProducts\ScreenSaver\Images\00BD9776.urr
c:\program files\FunWebProducts\ScreenSaver\Images\00BDA272.dat
c:\program files\FunWebProducts\ScreenSaver\Images\0DD1E0D6.dat
c:\program files\FunWebProducts\ScreenSaver\Images\f3wallpp.bmp
c:\program files\FunWebProducts\ScreenSaver\Images\wrkparam.lst
c:\program files\FunWebProducts\Shared\0096A5DB.dat
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\FunWebProducts\Shared\Cache\WebfettiBtn-new.html
c:\program files\FunWebProducts\Shared\Cache\WebfettiBtn.html
c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\program files\Mozilla Firefox\plugins\npclntax_ZangoSA.dll
C:\setup.exe
c:\windows\system32\f3PSSavr.scr

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MYWEBSEARCHSERVICE
——-\Service_MyWebSearchService

((((((((((((((((((((((((( Files Created from 2010-06-10 to 2010-07-10 )))))))))))))))))))))))))))))))
.

2010-07-10 00:39 . 2010-07-10 00:39 ——– d—–w- C:\_OTL
2010-06-29 10:17 . 2009-12-12 05:20 107520 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\IE8GuardWorkaround.exe
2010-06-29 10:17 . 2009-12-11 21:03 197632 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\TbHelper2.exe
2010-06-29 10:17 . 2009-12-11 21:02 49664 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\clearhist.exe
2010-06-29 10:17 . 2009-12-11 21:02 56832 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\update.exe
2010-06-29 10:17 . 2009-12-11 21:02 42496 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstall.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-10 00:28 . 2010-01-15 02:30 ——– d—–w- c:\documents and settings\Rachael\Application Data\Toolbar4
2010-07-10 00:27 . 2009-10-03 22:41 ——– d—–w- c:\program files\Coupons
2010-07-02 13:03 . 2009-05-30 03:49 ——– d—–w- c:\program files\Lx_cats
2010-06-25 18:38 . 2010-04-10 01:38 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-06-06 19:52 . 2010-06-06 19:52 65536 —-a-w- c:\windows\system32\afasrv32.exe
2010-06-06 19:52 . 2010-06-06 19:52 ——– d—–w- c:\program files\USIM Editor
2010-06-06 18:27 . 2009-08-30 00:46 ——– d—–w- c:\program files\Microsoft Silverlight
2010-06-05 12:47 . 2010-06-05 12:47 ——– d—–w- c:\program files\iLike
2010-05-28 18:38 . 2010-05-28 18:38 61440 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7d495df8-n\decora-sse.dll
2010-05-28 18:38 . 2010-05-28 18:38 503808 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f060aa4-n\msvcp71.dll
2010-05-28 18:38 . 2010-05-28 18:38 499712 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f060aa4-n\jmc.dll
2010-05-28 18:38 . 2010-05-28 18:38 348160 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f060aa4-n\msvcr71.dll
2010-05-28 18:38 . 2010-05-28 18:38 12800 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7d495df8-n\decora-d3d.dll
2010-05-27 23:09 . 2010-05-27 23:09 61440 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-786791ef-n\decora-sse.dll
2010-05-27 23:09 . 2010-05-27 23:09 503808 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5164bdda-n\msvcp71.dll
2010-05-27 23:09 . 2010-05-27 23:09 499712 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5164bdda-n\jmc.dll
2010-05-27 23:09 . 2010-05-27 23:09 348160 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5164bdda-n\msvcr71.dll
2010-05-27 23:09 . 2010-05-27 23:09 12800 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-786791ef-n\decora-d3d.dll
2010-05-19 01:27 . 2010-05-19 01:27 50354 —-a-w- c:\documents and settings\Rachael\Application Data\Facebook\uninstall.exe
2010-05-19 01:27 . 2010-02-27 04:16 ——– d—–w- c:\documents and settings\Rachael\Application Data\Facebook
2010-05-12 03:39 . 2010-05-12 03:39 ——– d—–w- c:\documents and settings\Rachael\Application Data\Documents and Settings
2010-05-06 10:41 . 2004-08-04 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-04 12:00 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:30 . 2004-08-04 12:00 285696 —-a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"iLike"="c:\program files\iLike\1.2.17\ilikesidebar.exe" [2008-09-10 63024]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-04 131072]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-08 2048352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SoundMan"="SOUNDMAN.EXE" [2005-05-13 67584]
"LXCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-07-20 73728]
"lxcgmon.exe"="c:\program files\Lexmark 2300 Series\lxcgmon.exe" [2005-07-21 200704]
"EzPrint"="c:\program files\Lexmark 2300 Series\ezprint.exe" [2005-08-01 94208]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-28 13:41 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaws.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/19/2009 8:39 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/19/2009 8:39 PM 108552]
R2 AfaService;Afa Card Reader Service;c:\windows\system32\afasrv32.exe [6/6/2010 2:52 PM 65536]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [4/19/2009 8:39 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [4/19/2009 8:39 PM 297752]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/29/2010 10:01 PM 135664]
S3 MHIKEY10;MHIKEY10;c:\windows\system32\drivers\MHIKEY10.sys [6/6/2010 2:52 PM 51072]
.
Contents of the 'Scheduled Tasks' folder

2010-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 03:01]

2010-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 03:01]

2010-07-10 c:\windows\Tasks\User_Feed_Synchronization-{1FDC5226-2B05-4DC6-B1FF-B20665AC6591}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]

2010-07-10 c:\windows\Tasks\User_Feed_Synchronization-{6696834B-005D-4A5C-8C9E-5421B5B60F20}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.facebook.com/home.php
uInternet Settings,ProxyOverride =
FF - ProfilePath - c:\documents and settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v;=18&q;=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v;=18&tid;={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}&q;=
FF - plugin: c:\documents and settings\Rachael\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-09 20:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3924)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\lxcgcoms.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2010-07-09 20:29:55 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-10 01:29

Pre-Run: 58,548,989,952 bytes free
Post-Run: 57,371,127,808 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 94B2C46B8E27C9484B1F4C9FB16B2FC3
Thank you so much

SweetTech

Post #6July 10, 2010, 1:56 AM UTC

Hello,

We still have some work to do.

ComboFix Script

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::
Folder::
c:\documents and settings\Rachael\Application Data\Toolbar4

Firefox::
FF - ProfilePath - c:\documents and settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}&q=

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT:

Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT:

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

NEXT:

OTL Custom Scan

We need to run an OTL Custom Scan

Please reopen [external image: Posted Image] on your desktop.
Copy and Paste the following bolded text into the [external image: Posted Image] textbox.

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.dat
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Push [external image: Posted Image]
A report will open. Copy and Paste that report in your next reply.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that was produced after running the ComboFix scan.
3. The log that was produced after running the updated MalwareBytes' Anti-Malware scan.
4. The log that was produced after running the ESET Online Virus Scanner.
5. The log that was produced after running the OTL scan.
6. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Cheers,
SweetTech.

1rachaelm

Post #7July 10, 2010, 5:47 AM UTC

Hello

I would love to know how to prevent this from happening again, and is AVG Free actually sufficient protection?

ComboFix

ComboFix 10-07-08.02 - Rachael 07/09/2010 23:32:51.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.691 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Rachael\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Rachael\Application Data\Toolbar4

.
((((((((((((((((((((((((( Files Created from 2010-06-10 to 2010-07-10 )))))))))))))))))))))))))))))))
.

2010-07-10 00:39 . 2010-07-10 00:39 ——– d—–w- C:\_OTL
2010-06-29 10:17 . 2009-12-12 05:20 107520 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\IE8GuardWorkaround.exe
2010-06-29 10:17 . 2009-12-11 21:03 197632 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\TbHelper2.exe
2010-06-29 10:17 . 2009-12-11 21:02 49664 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\clearhist.exe
2010-06-29 10:17 . 2009-12-11 21:02 56832 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\update.exe
2010-06-29 10:17 . 2009-12-11 21:02 42496 —-a-w- c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstall.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-10 01:38 . 2010-04-10 01:38 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-07-10 00:27 . 2009-10-03 22:41 ——– d—–w- c:\program files\Coupons
2010-07-02 13:03 . 2009-05-30 03:49 ——– d—–w- c:\program files\Lx_cats
2010-06-06 19:52 . 2010-06-06 19:52 65536 —-a-w- c:\windows\system32\afasrv32.exe
2010-06-06 19:52 . 2010-06-06 19:52 ——– d—–w- c:\program files\USIM Editor
2010-06-06 18:27 . 2009-08-30 00:46 ——– d—–w- c:\program files\Microsoft Silverlight
2010-06-05 12:47 . 2010-06-05 12:47 ——– d—–w- c:\program files\iLike
2010-05-28 18:38 . 2010-05-28 18:38 61440 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7d495df8-n\decora-sse.dll
2010-05-28 18:38 . 2010-05-28 18:38 503808 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f060aa4-n\msvcp71.dll
2010-05-28 18:38 . 2010-05-28 18:38 499712 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f060aa4-n\jmc.dll
2010-05-28 18:38 . 2010-05-28 18:38 348160 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1f060aa4-n\msvcr71.dll
2010-05-28 18:38 . 2010-05-28 18:38 12800 —-a-w- c:\documents and settings\Rachael\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7d495df8-n\decora-d3d.dll
2010-05-27 23:09 . 2010-05-27 23:09 61440 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-786791ef-n\decora-sse.dll
2010-05-27 23:09 . 2010-05-27 23:09 503808 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5164bdda-n\msvcp71.dll
2010-05-27 23:09 . 2010-05-27 23:09 499712 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5164bdda-n\jmc.dll
2010-05-27 23:09 . 2010-05-27 23:09 348160 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5164bdda-n\msvcr71.dll
2010-05-27 23:09 . 2010-05-27 23:09 12800 —-a-w- c:\documents and settings\Justin\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-786791ef-n\decora-d3d.dll
2010-05-19 01:27 . 2010-05-19 01:27 50354 —-a-w- c:\documents and settings\Rachael\Application Data\Facebook\uninstall.exe
2010-05-19 01:27 . 2010-02-27 04:16 ——– d—–w- c:\documents and settings\Rachael\Application Data\Facebook
2010-05-12 03:39 . 2010-05-12 03:39 ——– d—–w- c:\documents and settings\Rachael\Application Data\Documents and Settings
2010-05-06 10:41 . 2004-08-04 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-04 12:00 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:30 . 2004-08-04 12:00 285696 —-a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"iLike"="c:\program files\iLike\1.2.17\ilikesidebar.exe" [2008-09-10 63024]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe" [2009-06-05 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-04 131072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SoundMan"="SOUNDMAN.EXE" [2005-05-13 67584]
"LXCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-07-20 73728]
"lxcgmon.exe"="c:\program files\Lexmark 2300 Series\lxcgmon.exe" [2005-07-21 200704]
"EzPrint"="c:\program files\Lexmark 2300 Series\ezprint.exe" [2005-08-01 94208]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaws.exe"=

R2 AfaService;Afa Card Reader Service;c:\windows\system32\afasrv32.exe [6/6/2010 2:52 PM 65536]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/29/2010 10:01 PM 135664]
S3 MHIKEY10;MHIKEY10;c:\windows\system32\drivers\MHIKEY10.sys [6/6/2010 2:52 PM 51072]
.
Contents of the 'Scheduled Tasks' folder

2010-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 03:01]

2010-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 03:01]

2010-07-10 c:\windows\Tasks\User_Feed_Synchronization-{1FDC5226-2B05-4DC6-B1FF-B20665AC6591}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]

2010-07-10 c:\windows\Tasks\User_Feed_Synchronization-{6696834B-005D-4A5C-8C9E-5421B5B60F20}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.facebook.com/home.php
uInternet Settings,ProxyOverride =
FF - ProfilePath - c:\documents and settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - plugin: c:\documents and settings\Rachael\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-09 23:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3944)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\lxcgcoms.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2010-07-09 23:42:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-10 04:42
ComboFix2.txt 2010-07-10 01:29

Pre-Run: 57,743,421,440 bytes free
Post-Run: 57,737,674,752 bytes free

- - End Of File - - 6EE84581210B48C166444EACCF1D4EC1

MBAM

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4298

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/9/2010 11:56:16 PM
mbam-log-2010-07-09 (23-56-16).txt

Scan type: Quick scan
Objects scanned: 146098
Time elapsed: 5 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 50
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3popularscreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\[removed] (Adware.Zango) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESET

C:\Documents and Settings\Justin\My Documents\setup.exe a variant of Win32/Adware.180Solutions application
C:\Documents and Settings\Justin\My Documents\SetupGamevance.exe probably a variant of Win32/Adware.Gamevance.AD application
C:\Program Files\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application
C:\Program Files\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Setup.exe.vir a variant of Win32/Adware.180Solutions application
C:\Qoobox\Quarantine\C\Documents and Settings\Justin\Application Data\38500b0e.exe.vir a variant of Win32/Kryptik.FGR trojan
C:\Qoobox\Quarantine\C\Documents and Settings\Justin\Local Settings\Application Data\syssvc.exe.vir a variant of Win32/Kryptik.DUI trojan
C:\Qoobox\Quarantine\C\Documents and Settings\Justin\Local Settings\Application Data\xcjvfbrtp\pjaqngttssd.exe.vir Win32/Adware.SpywareProtect2009 application
C:\Qoobox\Quarantine\C\WINDOWS\system32\f3PSSavr.scr.vir Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001027.dll probably a variant of Win32/BHO trojan
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001044.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001045.DLL Win32/Adware.FunWeb application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001046.DLL Win32/Adware.FunWeb application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001047.DLL Win32/Toolbar.MyWebSearch.G application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001048.DLL Win32/Toolbar.MyWebSearch.B application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001049.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001050.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001051.DLL Win32/Adware.FunWeb application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001052.SCR Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001053.DLL Win32/Toolbar.MyWebSearch.G application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001054.DLL Win32/Toolbar.MyWebSearch.D application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001055.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001056.EXE Win32/Adware.FunWeb application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001057.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001059.DLL Win32/Toolbar.MyWebSearch.H application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001060.DLL Win32/Toolbar.MyWebSearch.I application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001061.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001062.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001063.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001064.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001065.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001066.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001067.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001068.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001069.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001070.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001071.EXE Win32/Toolbar.MyWebSearch.J application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001072.EXE Win32/Toolbar.MyWebSearch.I application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001073.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001074.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001075.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001076.DLL Win32/Toolbar.MyWebSearch.J application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001077.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001078.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001079.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001080.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001081.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001082.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001085.EXE Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001086.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001087.DLL Win32/Toolbar.MyWebSearch application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001090.dll a variant of Win32/Adware.HotBar.E application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001091.dll a variant of Win32/Adware.HotBar.E application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001092.dll Win32/Adware.HotBar application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001093.dll a variant of Win32/Adware.HotBar.E application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001095.exe Win32/Adware.HotBar application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001096.exe a variant of Win32/Adware.HotBar.E application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001097.dll a variant of Win32/Adware.HotBar.E application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001099.exe probably a variant of Win32/Agent trojan
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001100.dll Win32/Adware.HotBar application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001101.exe probably a variant of Win32/Adware.180Solutions application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001102.exe a variant of Win32/Adware.HotBar.E application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001103.dll a variant of Win32/Adware.HotBar.E application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001104.exe multiple threats
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001107.exe multiple threats
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001108.dll Win32/Adware.Toolbar.Shopper application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001110.dll probably a variant of Win32/BHO trojan
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001155.exe probably a variant of Win32/Adware.Gamevance.AH application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001156.exe a variant of Win32/Adware.Gamevance.AH application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001157.exe Win32/TrojanDownloader.FakeAlert.BAH trojan
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001158.exe Win32/TrojanDownloader.FakeAlert.BAH trojan
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001159.exe Win32/Adware.SpywareProtect2009 application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001161.exe Win32/Adware.SpywareProtect2009 application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001162.exe Win32/Adware.SpywareProtect2009 application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001165.exe a variant of Win32/Kryptik.FGR trojan
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001166.exe a variant of Win32/Kryptik.DUI trojan
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001167.exe Win32/Adware.SpywareProtect2009 application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001170.exe a variant of Win32/Adware.180Solutions application
C:\System Volume Information\_restore{8AEE49E9-7E00-4AB4-B797-B9D05D4FC92C}\RP0\A0001171.scr Win32/Toolbar.MyWebSearch application
C:\_OTL\MovedFiles\07092010_193935\C_Documents and Settings\Rachael\Local Settings\Application Data\gtplacfsu\dartuahtssd.exe Win32/Adware.SpywareProtect2009 application
Operating memory Win32/Toolbar.MyWebSearch application

OTL

OTL logfile created on: 7/10/2010 12:38:13 AM - Run 2
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\Rachael\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 533.00 Mb Available Physical Memory | 52.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 72.34 Gb Total Space | 53.65 Gb Free Space | 74.17% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DEFAULT-098E06D
Current User Name: Rachael
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Rachael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\system32\afasrv32.exe ()
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
PRC - C:\WINDOWS\system32\lxcgcoms.exe ( )
PRC - C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe (Hewlett-Packard Co.)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Rachael\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AfaService) – C:\WINDOWS\system32\afasrv32.exe ()
SRV - (lxcg_device) – C:\WINDOWS\System32\lxcgcoms.exe ( )
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (MHIKEY10) – C:\WINDOWS\system32\drivers\MHIKEY10.sys (Generic USB smartcard reader)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvatabus) – C:\WINDOWS\system32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nv_agp) – C:\WINDOWS\system32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v;=18&q;="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..browser.startup.homepage: "http://en-US.start2.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v;=18&tid;={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}&q;="

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MyWebSearch\bar\2.bin File not found
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/09 20:22:03 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/09 20:22:04 | 000,000,000 | —D | M]

[2009/04/19 21:06:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Mozilla\Extensions
[2010/07/09 16:58:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions
[2009/11/01 10:59:18 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/03 17:42:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}
[2010/07/09 16:58:13 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/10/03 17:42:57 | 000,003,700 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.png
[2009/10/03 17:42:58 | 000,001,963 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.xml

O1 HOSTS File: ([2010/07/09 23:38:53 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard)
O4 - HKLM..\Run: [LXCGCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.DLL ()
O4 - HKLM..\Run: [lxcgmon.exe] C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [iLike] C:\Program Files\iLike\1.2.17\ilikesidebar.exe (iLike)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -Mozilla\4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident\4.0; File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1240194932609 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} https://ediagnostics.lexmark.com/serval.cab (Lexmark eDiagnostics Class)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Rachael\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Rachael\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/19 20:03:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/10 00:02:06 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/07/09 23:49:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Rachael\Application Data\Malwarebytes
[2010/07/09 23:49:18 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/09 23:49:17 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/09 23:49:17 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/09 23:49:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/09 23:47:43 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Rachael\Desktop\mbam-setup-1.46.exe
[2010/07/09 23:37:19 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/07/09 20:07:23 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/07/09 20:05:37 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/07/09 20:05:37 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/07/09 20:05:37 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/07/09 20:05:37 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/07/09 20:05:32 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/07/09 19:56:51 | 000,000,000 | —D | C] – C:\Qoobox
[2010/07/09 19:39:35 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/09 17:07:39 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Rachael\Desktop\OTL.exe
[2010/07/09 16:47:38 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2009/05/29 22:48:23 | 001,183,744 | —- | C] ( ) – C:\WINDOWS\System32\lxcgserv.dll
[2009/05/29 22:48:23 | 001,134,592 | —- | C] ( ) – C:\WINDOWS\System32\lxcgusb1.dll
[2009/05/29 22:48:23 | 000,155,648 | —- | C] ( ) – C:\WINDOWS\System32\lxcgprox.dll
[2009/05/29 22:48:23 | 000,114,688 | —- | C] ( ) – C:\WINDOWS\System32\lxcgpplc.dll
[2009/05/29 22:48:22 | 000,704,512 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomc.dll
[2009/05/29 22:48:22 | 000,483,328 | —- | C] ( ) – C:\WINDOWS\System32\lxcglmpm.dll
[2009/05/29 22:48:22 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxcgcomm.dll

========== Files - Modified Within 30 Days ==========

[2010/07/10 00:35:00 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{6696834B-005D-4A5C-8C9E-5421B5B60F20}.job
[2010/07/10 00:30:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/10 00:01:57 | 002,672,312 | —- | M] () – C:\Documents and Settings\Rachael\Desktop\esetsmartinstaller_enu.exe
[2010/07/09 23:49:20 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/09 23:47:42 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Rachael\Desktop\mbam-setup-1.46.exe
[2010/07/09 23:39:00 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/09 23:38:53 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/09 23:38:48 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/09 23:38:45 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/09 23:38:31 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/09 23:38:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/09 23:38:29 | 1073,270,784 | -HS- | M] () – C:\hiberfil.sys
[2010/07/09 23:37:32 | 003,670,016 | —- | M] () – C:\Documents and Settings\Rachael\ntuser.dat
[2010/07/09 23:37:32 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Rachael\ntuser.ini
[2010/07/09 23:37:27 | 003,231,112 | -H– | M] () – C:\Documents and Settings\Rachael\Local Settings\Application Data\IconCache.db
[2010/07/09 20:38:32 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/09 20:26:44 | 000,000,426 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{1FDC5226-2B05-4DC6-B1FF-B20665AC6591}.job
[2010/07/09 20:07:27 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/07/09 19:54:15 | 003,728,667 | R— | M] () – C:\Documents and Settings\Rachael\Desktop\ComboFix.exe
[2010/07/09 17:07:35 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Rachael\Desktop\OTL.exe
[2010/06/29 16:28:16 | 000,870,128 | —- | M] () – C:\Documents and Settings\Rachael\Application Data\mcs.rma
[2010/06/29 16:28:16 | 000,000,004 | —- | M] () – C:\Documents and Settings\Rachael\Application Data\78A677
[2010/06/23 03:02:49 | 000,500,732 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/23 03:02:49 | 000,440,684 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/23 03:02:49 | 000,071,002 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2010/07/10 00:01:43 | 002,672,312 | —- | C] () – C:\Documents and Settings\Rachael\Desktop\esetsmartinstaller_enu.exe
[2010/07/09 23:49:20 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/09 20:24:11 | 1073,270,784 | -HS- | C] () – C:\hiberfil.sys
[2010/07/09 20:07:27 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/07/09 20:07:23 | 000,260,272 | —- | C] () – C:\cmldr
[2010/07/09 20:05:37 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/07/09 20:05:37 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/07/09 20:05:37 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/07/09 20:05:37 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/09 20:05:37 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/07/09 19:54:09 | 003,728,667 | R— | C] () – C:\Documents and Settings\Rachael\Desktop\ComboFix.exe
[2009/05/29 23:40:12 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\hpzids01.dll
[2009/05/29 22:48:23 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxcgvs.dll
[2009/04/27 20:10:15 | 000,000,169 | —- | C] () – C:\WINDOWS\RtlRack.ini
[2009/04/19 21:32:11 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/04/19 21:24:48 | 000,000,164 | —- | C] () – C:\WINDOWS\avrack.ini
[2009/04/19 21:24:46 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/04/19 20:03:49 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/04/19 19:50:09 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/07/09 20:07:27 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2010/07/09 23:42:52 | 000,010,276 | —- | M] () – C:\ComboFix.txt
[2009/04/19 20:03:49 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/07/06 19:39:02 | 000,149,649 | —- | M] () – C:\Covered providers.pdf
[2009/04/19 20:58:04 | 007,518,920 | —- | M] (Mozilla) – C:\Firefox Setup 3.0.8.exe
[2010/07/09 23:38:29 | 1073,270,784 | -HS- | M] () – C:\hiberfil.sys
[2009/06/18 17:33:56 | 000,045,920 | —- | M] () – C:\ICRForms.pdf
[2009/06/18 17:35:33 | 000,038,864 | —- | M] () – C:\ICRForms2.pdf
[2009/06/18 17:35:47 | 000,182,315 | —- | M] () – C:\ICRForms3.pdf
[2010/01/21 21:20:36 | 000,003,145 | —- | M] () – C:\imgres.htm
[2009/04/19 20:03:49 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/07/03 17:10:23 | 000,090,162 | —- | M] () – C:\LCSCheatDevice10gPRX.zip
[2009/05/29 22:48:18 | 000,000,275 | —- | M] () – C:\lxcgfire.csv
[2009/05/29 22:48:32 | 000,000,867 | —- | M] () – C:\lxcginst.csv
[2010/06/25 14:21:28 | 000,001,080 | —- | M] () – C:\lxcgscan.log
[2009/04/19 20:03:49 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/06/06 17:56:20 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/07/09 23:38:28 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2009/07/03 17:09:17 | 000,379,329 | —- | M] () – C:\VCSCheatDevice24.zip
[2009/07/06 19:41:19 | 000,344,357 | —- | M] () – C:\Wellmark_PDL_2009.pdf

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >
[2005/05/11 23:36:48 | 000,012,288 | —- | M] (Hewlett-Packard Co.) – C:\WINDOWS\Fonts\RandFont.dll

< %systemroot%\Fonts\*.ini >
[2009/04/19 20:03:15 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/05/05 08:48:54 | 000,067,072 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll
[2005/08/17 00:53:52 | 000,073,728 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxcgpp5c.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.dat >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/04/19 14:38:02 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/04/19 14:38:01 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/04/19 14:38:01 | 000,901,120 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/13 19:12:08 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/13 19:12:10 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/13 19:12:10 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-23 08:03:44
< End of report >

SweetTech

Post #8July 10, 2010, 4:46 PM UTC

Hello,

I'll provide my usual All Clean Speech to you when we get you all cleaned up.

Your logs are looking good, we just have a few last things to take care of.

OTL Fix

We need to run an OTL Fix

Please reopen [external image: Posted Image] on your desktop.

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:Services
:OTL
FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"
FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q="
FF - prefs.js..browser.search.order.1: "Fast Browser Search"
FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}&q="
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MyWebSearch\bar\2.bin File not found
[2009/10/03 17:42:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}
[2009/10/03 17:42:57 | 000,003,700 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.png
[2009/10/03 17:42:58 | 000,001,963 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\fast.xml
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
[2010/07/09 23:47:43 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Rachael\Desktop\mbam-setup-1.46.exe
[2010/07/10 00:01:57 | 002,672,312 | —- | M] () – C:\Documents and Settings\Rachael\Desktop\esetsmartinstaller_enu.exe

:Reg

:Files
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\IE8GuardWorkaround.exe
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\TbHelper2.exe
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\clearhist.exe
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\update.exe
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstall.exe
C:\Documents and Settings\Justin\My Documents\setup.exe
C:\Documents and Settings\Justin\My Documents\SetupGamevance.exe
C:\Program Files\Windows Live\Messenger\msimg32.dll
C:\Program Files\Windows Live\Messenger\riched20.dll
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Update FireFox
While in Firefox go to the Help menu.
Locate Check for Updates.
Allow Firefox to install the latest update. Which is 3.6.6

NEXT:

Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Look for "JDK 6 Update 21 (JDK or JRE)".
Click the "Download JRE" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.
If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
When the Java Setup - Welcome window opens, click the Install > button.
If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

– Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
– Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note:
The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications.
To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.

NEXT

Clean Java Cache & Temporary Files

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT:

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it in your next reply.

NEXT:

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

1rachaelm

Post #9July 10, 2010, 11:22 PM UTC

Hello-
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: "Fast Browser Search" removed from browser.search.defaultenginename
Prefs.js: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q=" removed from browser.search.defaulturl
Prefs.js: "Fast Browser Search" removed from browser.search.order.1
Prefs.js: "Fast Browser Search" removed from browser.search.selectedEngine
Prefs.js: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={46CFCA29-E367-EABC-9EE1-AF6B139BB2F9}&q=" removed from keyword.URL
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed] deleted successfully.
C:\Documents and Settings\Rachael\Application Data\Mozilla\Firefox\Profiles\76ki4zwo.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB} folder moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\fast.png moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\fast.xml moved successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
C:\Documents and Settings\Rachael\Desktop\mbam-setup-1.46.exe moved successfully.
C:\Documents and Settings\Rachael\Desktop\esetsmartinstaller_enu.exe moved successfully.
========== REGISTRY ==========
========== FILES ==========
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\IE8GuardWorkaround.exe moved successfully.
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\TbHelper2.exe moved successfully.
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\clearhist.exe moved successfully.
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\update.exe moved successfully.
c:\documents and settings\Justin\Application Data\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstall.exe moved successfully.
C:\Documents and Settings\Justin\My Documents\setup.exe moved successfully.
C:\Documents and Settings\Justin\My Documents\SetupGamevance.exe moved successfully.
C:\Program Files\Windows Live\Messenger\msimg32.dll moved successfully.
C:\Program Files\Windows Live\Messenger\riched20.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Application Data

User: cs

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Documents and Settings

User: Justin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Rachael
->Temp folder emptied: 98287768 bytes
->Temporary Internet Files folder emptied: 1436356 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 70016248 bytes
->Flash cache emptied: 589 bytes

User: report

User: ShoppingReport

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 643 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 162.00 mb

[EMPTYFLASH]

User: All Users

User: Application Data

User: cs

User: Default User

User: Documents and Settings

User: Justin
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Rachael
->Flash cache emptied: 0 bytes

User: report

User: ShoppingReport

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.8.1 log created on 07102010_174355

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

JavaRa 1.15 Removal Log.

Report follows after line.

————————————

The JavaRa removal process was started on Sat Jul 10 18:08:49 2010

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

————————————

Finished reporting.

Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Free 9.0
ESET Online Scanner v3
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 21
Out of date Java installed!
Adobe Flash Player 10.0.45.2
Adobe Reader 9.1
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.6)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

SweetTech

Post #10July 10, 2010, 11:25 PM UTC

Hello,

Your logs appear to be clean, so if you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.

NEXT:

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy

Go to Start > Control Panel > Add/Remove Programs
Remove ALL instances of Adobe Reader
Re-boot your computer as required.
Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader

Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

NEXT:

Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall

NEXT:

OTL Clean-Up
Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

NEXT:

All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
- If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
  - NoScript - for blocking ads and other potential website attacks
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.

1rachaelm

Post #11July 11, 2010, 2:33 PM UTC

Ok-clean up complete and all tools suggested have been downloaded-thank you so much! Rachael

SweetTech

Post #12July 11, 2010, 4:55 PM UTC

Your more than welcome. I'm glad I was able to be of assistance. Cheers, SweetTech.

SweetTech

Post #13July 11, 2010, 4:55 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Cannot access Windows XP outside of safe mode

✨ Ask AI

Ask AI