What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware Searchqu/Hijack This Scan

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I downloaded a piece of vector art on Wednesday from the internet and it came with iLivid utility to open it. Since then, internet explorer no longer works. I tried installing an update to explorer (8) with no better luck. I found Bandoo Media Seachqu Toolbar add-on and have disabled it but am not able to remove it. I am able to go online via Chrome even though it defaults to ww searchqu.com/406 whenever I open it. I am not real saavy when it comes to fixing things of this nature…I tried to run spybotsd162 but it would not even start. I do not know if this is usual or not but Hijack errored twice when I ran it?



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:40:22 PM, on 5/13/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Starfield\offSyncService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\PROGRA~1\WI371A~1\Datamngr\DATAMN~1.EXE
C:\Program Files\Starfield\WorkspaceUpdate.exe
C:\Documents and Settings\All Users\Application Data\Norton\NUA.exe
C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.53\GoogleCrashHandler.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Intuit\QuickBooks Enterprise Solutions 9.0\QBW32.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe
C:\WINDOWS\system32\rundll32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…all&pf=cmdt
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\4.3.0.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\4.3.0.5\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\ToolBar\searchqudtx.dll
O2 - BHO: UrlHelper Class - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\4.3.0.5\coIEPlg.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\ToolBar\searchqudtx.dll
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\WI371A~1\Datamngr\DATAMN~1.EXE
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Starfield Updater] "C:\Program Files\Starfield\WorkspaceUpdate.exe"
O4 - HKCU\..\Run: [NortonUpdateAgent] C:\Documents and Settings\All Users\Application Data\Norton\NUA.exe
O4 - HKCU\..\Run: [InstallIQUpdater] "C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe" /silent /autorun
O4 - Global Startup: Intuit Data Protect.lnk = C:\Program Files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: QuickBooks_Standard_21.lnk = C:\Program Files\Intuit\QuickBooks Enterprise Solutions 9.0\QBW32.EXE
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9.2.0…inAxControl.CAB
O16 - DPF: {00130000-B1BA-11CE-ABC6-F5B2E79D9E3F} (LEAD Main Control (13.0)) - http://aceonline.asicentral.com/ace/ltocx13n.cab
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://webgames.d.tmsrv.com/c=e054adda1aa6…houseplayer.cab
O18 - Protocol: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files\Intuit\QuickBooks Enterprise Solutions 9.0\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: File Backup Service (File Backup) - Starfield Technologies, Inc. - C:\Program Files\Starfield\offSyncService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Security Suite (N360) - Symantec Corporation - C:\Program Files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 13034 bytes
Post #2

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days. :)


Hello there, itsdot

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
Post #3
Hello there,

Please re-open HijackThis and click on Do a system scan only. Check the boxes next to all the entries listed below.(If exist)
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\ToolBar\searchqudtx.dll
O2 - BHO: UrlHelper Class - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\ToolBar\searchqudtx.dll
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\WI371A~1\Datamngr\DATAMN~1.EXE
O20 - AppInit_DLLs: C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll


Note : Do not worry if you are unable to find any of these entries, continue with the ones that you discovered. Now close all windows other than HijackThis, then click Fix checked. Close HijackThis and reboot please.

===================================================

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.com
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

[external image: Posted Image]
  • Please download GMER from one of the following locations, and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zip Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  • Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    [external image: Posted Image]

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
===================================================

On your next reply please post :
DDS log
GMER log
Checkup log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
Post #4
Hello Conspire, Thank you for coming to my rescue! I believe I have correctly followed all of the steps of the instructions. PLease advise if I have not:

DDS.txt:

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 16:34:32.62 on Sun 05/15/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2264 [GMT -5:00]
.
AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Starfield\offSyncService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Starfield\WorkspaceUpdate.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Documents and Settings\All Users\Application Data\Norton\NUA.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.53\GoogleCrashHandler.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Intuit\QuickBooks Enterprise Solutions 9.0\QBW32.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.comcast.net/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=all&pf=cmdt
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton security suite\engine\4.3.0.5\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton security suite\engine\4.3.0.5\IPSBHO.DLL
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton security suite\engine\4.3.0.5\coIEPlg.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Starfield Updater] "c:\program files\starfield\WorkspaceUpdate.exe"
uRun: [NortonUpdateAgent] c:\documents and settings\all users\application data\norton\NUA.exe
uRun: [InstallIQUpdater] "c:\program files\w3i\installiqupdater\InstallIQUpdater.exe" /silent /autorun
mRun: [PDF Complete] c:\program files\pdf complete\pdfsty.exe
mRun: [Recguard] c:\windows\sminst\Recguard.exe
mRun: [Reminder] c:\windows\creator\Remind_XP.exe
mRun: [Scheduler] c:\windows\sminst\Scheduler.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\intuit~1.lnk - c:\program files\common files\intuit\dataprotect\IntuitDataProtect.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~3.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~2.lnk - c:\program files\intuit\quickbooks enterprise solutions 9.0\QBW32.EXE
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
DPF: {00130000-B1BA-11CE-ABC6-F5B2E79D9E3F} - hxxp://aceonline.asicentral.com/ace/ltocx13n.cab
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://webgames.d.tmsrv.com/c=e054adda1aa6d10f6780af8e9d15df1e/aff=t_03cm_wg/p/release/gamehouse/wg_mindmedley/mindmedley/gamehouseplayer.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - c:\program files\intuit\quickbooks enterprise solutions 9.0\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Notify: LMIinit - LMIinit.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0403000.005\symds.sys [2011-3-5 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0403000.005\symefa.sys [2011-3-5 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\bashdefs\20110430.001\BHDrvx86.sys [2011-5-2 802936]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0403000.005\cchpx86.sys [2011-3-5 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0403000.005\ironx86.sys [2011-3-5 116784]
R2 File Backup;File Backup Service;c:\program files\starfield\offSyncService.exe [2011-2-2 1215216]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-4-6 54752]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2011-2-17 47640]
R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\4.3.0.5\ccsvchst.exe [2011-3-5 126392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2011-2-23 632792]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2010-4-6 576024]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2010-4-6 243856]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-5-10 105592]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\ipsdefs\20110513.001\IDSXpx86.sys [2011-5-13 341944]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20110515.002\NAVENG.SYS [2011-5-15 86136]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20110515.002\NAVEX15.SYS [2011-5-15 1393144]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-8-21 57248]
S1 SydexFDD;Sydex Diskette Driver;c:\windows\system32\drives\sydexfdd.sys –> c:\windows\system32\drives\sydexfdd.sys [?]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\rainfo.sys –> c:\program files\logmein\x86\RaInfo.sys [?]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
=============== Created Last 30 ================
.
2011-05-15 21:29:20 118784 —-a-w- c:\windows\system32\chg.exe
2011-05-12 21:59:18 ——– d-sh–w- c:\windows\system32\AI_RecycleBin
2011-05-12 21:59:17 ——– d—–w- c:\program files\W3i
2011-05-11 21:08:51 ——– dc-h–w- c:\windows\ie8
2011-05-11 13:11:25 ——– d—–w- c:\docume~1\admini~1\locals~1\applic~1\Ilivid Player
2011-05-11 13:11:15 ——– d—–w- c:\docume~1\admini~1\applic~1\searchquband
2011-05-11 13:10:45 ——– dc-h–w- c:\docume~1\alluse~1\applic~1\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}
2011-05-11 13:10:36 ——– d—–w- c:\program files\iLivid
2011-05-11 13:10:25 ——– d—–w- c:\docume~1\admini~1\applic~1\searchqutoolbar
2011-05-11 13:10:15 ——– d—–w- c:\program files\Windows iLivid Toolbar
2011-05-11 13:10:03 ——– d—–w- c:\docume~1\admini~1\locals~1\applic~1\PackageAware
2011-04-19 23:03:20 ——– d—–w- c:\program files\iPod
2011-04-19 23:03:18 ——– d—–w- c:\program files\iTunes
2011-04-19 23:00:42 ——– d—–w- c:\program files\Bonjour
.
==================== Find3M ====================
.
2011-04-06 21:20:16 91424 —-a-w- c:\windows\system32\dnssd.dll
2011-04-06 21:20:16 107808 —-a-w- c:\windows\system32\dns-sd.exe
2011-03-07 05:33:50 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 16:50:08 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2011-03-04 06:37:06 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06:29 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06:29 43520 ——w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06:29 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41:59 385024 ——w- c:\windows\system32\html.iec
2011-02-17 12:32:12 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56:39 290432 —-a-w- c:\windows\system32\atmfd.dll
.
============= FINISH: 16:35:07.48 ===============

Attach.txt is attached

GMER log follows:
GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-15 18:42:04
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST350041 rev.HP11
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxtdapow.sys


—- System - GMER 1.0.15 —-

SSDT 893B5050 ZwAlertResumeThread
SSDT 893B7050 ZwAlertThread
SSDT 89337AF8 ZwAllocateVirtualMemory
SSDT 8939D050 ZwAssignProcessToJobObject
SSDT 89B29690 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xB4820210]
SSDT 89326EB0 ZwCreateMutant
SSDT 892CE3C0 ZwCreateSymbolicLinkObject
SSDT 893877F0 ZwCreateThread
SSDT 8939F050 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xB4820490]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xB48209F0]
SSDT 89361730 ZwDuplicateObject
SSDT 89331D70 ZwFreeVirtualMemory
SSDT 893AD050 ZwImpersonateAnonymousToken
SSDT 893B3050 ZwImpersonateThread
SSDT 89AAA598 ZwLoadDriver
SSDT 89331C90 ZwMapViewOfSection
SSDT 893AA050 ZwOpenEvent
SSDT 893876D8 ZwOpenProcess
SSDT 893C2050 ZwOpenProcessToken
SSDT 893A6050 ZwOpenSection
SSDT 89361800 ZwOpenThread
SSDT 892CE490 ZwProtectVirtualMemory
SSDT 893B9050 ZwResumeThread
SSDT 893BF050 ZwSetContextThread
SSDT 8932F170 ZwSetInformationProcess
SSDT 893A1050 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xB4820C40]
SSDT 893A8050 ZwSuspendProcess
SSDT 893BB050 ZwSuspendThread
SSDT 893C4050 ZwTerminateProcess
SSDT 893BD050 ZwTerminateThread
SSDT 89A5F050 ZwUnmapViewOfSection
SSDT 89331E00 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

? SYMDS.SYS The system cannot find the file specified. !
? SYMEFA.SYS The system cannot find the file specified. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB71FF380, 0x566445, 0xE8000020]
? C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!GetSysColor 7E418E78 5 Bytes JMP 004170D0 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!GetSysColorBrush 7E418EAB 5 Bytes JMP 00417140 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!SetScrollInfo 7E419056 7 Bytes JMP 00416FC0 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!GetScrollInfo 7E42DFE2 7 Bytes JMP 00416F10 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!ShowScrollBar 7E42F2F2 5 Bytes JMP 00417090 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!GetScrollPos 7E42F704 5 Bytes JMP 00416F50 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!SetScrollPos 7E42F750 5 Bytes JMP 00417000 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!GetScrollRange 7E42F787 5 Bytes JMP 00416F80 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!SetScrollRange 7E42F99B 5 Bytes JMP 00417040 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\SMINST\Scheduler.exe[564] USER32.dll!EnableScrollBar 7E468005 7 Bytes JMP 00416ED0 C:\WINDOWS\SMINST\Scheduler.exe
.text C:\WINDOWS\system32\SearchIndexer.exe[2964] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-


Checkup log follows:

Results of screen317's Security Check version 0.99.11
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Java™ 6 Update 7
Out of date Java installed!
Adobe Flash Player
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
``````````End of Log````````````


Awaiting next instructions. Thanks much, Dot

Attachments:

Post #5
Hello there,

***Read through this entire procedure and if you have any questions, please ask them before you begin. Copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. Do take note that if you could not run any tools requested, carry on with the next instruction(if any) and let us know.


You've done well so far. :thumbup:

Please read through these instructions to familarize yourself with what to expect when this tool runs


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

    **********************************************
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #6
Good morning Conspire,
I have executed the next steps. When running ComboFix the first time, I got a blue screen error and it shut down my computer. When the computer restarted, I waited several minutes to see if it was part of the program and if something would start back up but it did not appear to be so I re-ran ComboFix. On the second run, it ran all the way through without incident. The log file for that run is below. I await your next instructions. Thanks you, Dot


ComboFix 11-05-15.04 - Administrator 05/16/2011 10:05:12.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2465 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\g2mdlhlpx.exe
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\ST6UNST.000
D:\Autorun.inf
F:\autorun.inf
.
—– BITS: Possible infected sites —–
.
hxxp://buy-download.norton.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_SydexFDD
.
.
((((((((((((((((((((((((( Files Created from 2011-04-16 to 2011-05-16 )))))))))))))))))))))))))))))))
.
.
2011-05-12 21:59 . 2011-05-12 21:59 ——– d-sh–w- c:\windows\system32\AI_RecycleBin
2011-05-12 21:59 . 2011-05-12 21:59 ——– d—–w- c:\program files\W3i
2011-05-11 21:08 . 2011-05-11 21:18 ——– dc-h–w- c:\windows\ie8
2011-05-11 13:22 . 2011-05-11 13:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\vlc
2011-05-11 13:11 . 2011-05-11 13:11 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Ilivid Player
2011-05-11 13:11 . 2011-05-11 13:11 ——– d—–w- c:\documents and settings\Administrator\Application Data\searchquband
2011-05-11 13:10 . 2011-05-11 13:10 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}
2011-05-11 13:10 . 2011-05-11 13:10 ——– d—–w- c:\program files\iLivid
2011-05-11 13:10 . 2011-05-11 13:11 ——– d—–w- c:\documents and settings\Administrator\Application Data\searchqutoolbar
2011-05-11 13:10 . 2011-05-11 13:10 ——– d—–w- c:\program files\Windows iLivid Toolbar
2011-05-11 13:10 . 2011-05-11 13:10 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\PackageAware
2011-04-19 23:03 . 2011-04-19 23:03 ——– d—–w- c:\program files\iPod
2011-04-19 23:03 . 2011-04-19 23:03 ——– d—–w- c:\program files\iTunes
2011-04-19 23:00 . 2011-04-19 23:00 ——– d—–w- c:\program files\Bonjour
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-06 21:20 . 2011-04-06 21:20 91424 —-a-w- c:\windows\system32\dnssd.dll
2011-04-06 21:20 . 2011-04-06 21:20 107808 —-a-w- c:\windows\system32\dns-sd.exe
2011-03-07 05:33 . 2008-04-14 12:41 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 16:50 . 2011-03-04 16:50 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2011-03-04 16:50 . 2011-03-04 16:50 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-03-04 06:37 . 2008-04-14 12:42 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2008-04-14 08:00 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2008-04-14 12:42 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 23:06 . 2008-04-14 12:42 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2008-04-14 12:41 43520 ——w- c:\windows\system32\licmgr10.dll
2011-02-22 11:41 . 2008-04-14 07:07 385024 ——w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2008-04-14 07:47 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2008-04-14 07:45 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2010-04-06 15:38 5120 —-a-w- c:\windows\system32\xpsp4res.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Starfield Updater"="c:\program files\Starfield\WorkspaceUpdate.exe" [2011-03-14 33984]
"NortonUpdateAgent"="c:\documents and settings\All Users\Application Data\Norton\NUA.exe" [2011-04-05 2692024]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-05-10 1205760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-04-07 318488]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]
"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2010-08-09 1394440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2011-5-6 5794648]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2010-8-25 1156384]
QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks Enterprise Solutions 9.0\QBW32.EXE [2010-8-25 1178400]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-12-08 19:11 87424 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Web Connector.lnk]
backup=c:\windows\pss\QuickBooks Web Connector.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2010-09-22 23:11 640440 —-a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2011-01-31 06:36 38840 —-a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 12:58 611712 —-a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-04-20 17:48 58656 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 16:32 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 21:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetRefresh]
2003-11-20 19:01 525824 —-a-w- c:\program files\Compaq\SetRefresh\SetRefresh.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\Intuit\\QuickBooks Enterprise Solutions 9.0\\QBDBMgrN.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows iLivid Toolbar\\ToolBar\\dtUser.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\symds.sys [3/5/2011 2:50 AM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\symefa.sys [3/5/2011 2:50 AM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110430.001\BHDrvx86.sys [5/2/2011 4:48 PM 802936]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\cchpx86.sys [3/5/2011 2:50 AM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\ironx86.sys [3/5/2011 2:50 AM 116784]
R2 File Backup;File Backup Service;c:\program files\Starfield\offSyncService.exe [2/2/2011 11:12 AM 1215216]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\4.3.0.5\ccsvchst.exe [3/5/2011 2:50 AM 126392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2/23/2011 12:27 PM 632792]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [4/6/2010 12:18 PM 576024]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [4/6/2010 2:04 PM 243856]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/10/2011 7:28 PM 105592]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110513.001\IDSXpx86.sys [5/13/2011 8:20 PM 341944]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [8/21/2009 8:24 PM 57248]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys –> c:\program files\LogMeIn\x86\RaInfo.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2355742841-584557978-1302645805-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-07 20:59]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2355742841-584557978-1302645805-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-07 20:59]
.
2011-05-16 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2011-02-23 17:28]
.
2011-05-16 c:\windows\Tasks\RMSmartUpdate.job
- c:\program files\Registry Mechanic\Update.exe [2011-02-23 17:28]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - c:\program files\Intuit\QuickBooks Enterprise Solutions 9.0\HelpAsyncPluggableProtocol.dll
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://webgames.d.tmsrv.com/c=e054adda1aa6d10f6780af8e9d15df1e/aff=t_03cm_wg/p/release/gamehouse/wg_mindmedley/mindmedley/gamehouseplayer.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-16 10:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\4.3.0.5\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2355742841-584557978-1302645805-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6f,4d,8d,54,06,dc,97,4b,b8,03,d6,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(836)
c:\windows\system32\LMIinit.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'explorer.exe'(4020)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
c:\windows\system32\SearchProtocolHost.exe
.
**************************************************************************
.
Completion time: 2011-05-16 10:16:50 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-16 15:16
.
Pre-Run: 428,628,127,744 bytes free
Post-Run: 429,773,045,760 bytes free
.
- - End Of File - - B4D3A07612EF0DD70AC30A30F67773B4
Post #7
Hello again,

Thanks for the log.

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Folder::
c:\documents and settings\Administrator\Local Settings\Application Data\Ilivid Player
c:\documents and settings\Administrator\Application Data\searchquband
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}
c:\program files\iLivid
c:\documents and settings\Administrator\Application Data\searchqutoolbar
c:\program files\Windows iLivid Toolbar
c:\documents and settings\Administrator\Local Settings\Application Data\PackageAware

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Windows iLivid Toolbar\\ToolBar\\dtUser.exe"=-


In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]
Post #8
Hi Conspire,
This is the latest log file from that run. As an aside, when I started Chrome, it still points to http://www.searchqu.com/406?


ComboFix 11-05-15.04 - Administrator 05/16/2011 11:46:29.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2381 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\searchquband
c:\documents and settings\Administrator\Application Data\searchqutoolbar
c:\documents and settings\Administrator\Application Data\searchqutoolbar\dtx.ini
c:\documents and settings\Administrator\Application Data\searchqutoolbar\guid.dat
c:\documents and settings\Administrator\Application Data\searchqutoolbar\preferences.dat
c:\documents and settings\Administrator\Application Data\searchqutoolbar\setupCfg.xml
c:\documents and settings\Administrator\Local Settings\Application Data\Ilivid Player
c:\documents and settings\Administrator\Local Settings\Application Data\Ilivid Player\script.qscript
c:\documents and settings\Administrator\Local Settings\Application Data\PackageAware
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.dat
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.exe
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.lnk
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.msi
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.par
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.res
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\instance.dat
c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\mia.lib
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\iLivid
c:\program files\iLivid\ilivid.exe
c:\program files\iLivid\ilivid.ico
c:\program files\iLivid\imageformats\qgif4.dll
c:\program files\iLivid\imageformats\qjpeg4.dll
c:\program files\iLivid\libeay32.dll
c:\program files\iLivid\libgcc_s_dw2-1.dll
c:\program files\iLivid\mingwm10.dll
c:\program files\iLivid\phonon4.dll
c:\program files\iLivid\QtCore4.dll
c:\program files\iLivid\QtGui4.dll
c:\program files\iLivid\QtNetwork4.dll
c:\program files\iLivid\QtScript4.dll
c:\program files\iLivid\QtSvg4.dll
c:\program files\iLivid\QtWebKit4.dll
c:\program files\iLivid\QtXmlPatterns4.dll
c:\program files\iLivid\script.qscript
c:\program files\iLivid\script1.81.qscript
c:\program files\iLivid\ssleay32.dll
c:\program files\iLivid\VLC\activex\axvlc.dll
c:\program files\iLivid\VLC\activex\axvlc.dll.manifest
c:\program files\iLivid\VLC\activex\README.TXT
c:\program files\iLivid\VLC\activex\test.html
c:\program files\iLivid\VLC\AUTHORS.txt
c:\program files\iLivid\VLC\COPYING.txt
c:\program files\iLivid\VLC\http\.hosts
c:\program files\iLivid\VLC\http\dialogs\.hosts
c:\program files\iLivid\VLC\http\dialogs\browse
c:\program files\iLivid\VLC\http\dialogs\footer
c:\program files\iLivid\VLC\http\dialogs\input
c:\program files\iLivid\VLC\http\dialogs\main
c:\program files\iLivid\VLC\http\dialogs\mosaic
c:\program files\iLivid\VLC\http\dialogs\playlist
c:\program files\iLivid\VLC\http\dialogs\sout
c:\program files\iLivid\VLC\http\dialogs\vlm
c:\program files\iLivid\VLC\http\favicon.ico
c:\program files\iLivid\VLC\http\flash.html
c:\program files\iLivid\VLC\http\iehacks.css
c:\program files\iLivid\VLC\http\images\delete.png
c:\program files\iLivid\VLC\http\images\delete_small.png
c:\program files\iLivid\VLC\http\images\eject.png
c:\program files\iLivid\VLC\http\images\empty.png
c:\program files\iLivid\VLC\http\images\fullscreen.png
c:\program files\iLivid\VLC\http\images\help.png
c:\program files\iLivid\VLC\http\images\info.png
c:\program files\iLivid\VLC\http\images\loop.png
c:\program files\iLivid\VLC\http\images\minus.png
c:\program files\iLivid\VLC\http\images\next.png
c:\program files\iLivid\VLC\http\images\pause.png
c:\program files\iLivid\VLC\http\images\play.png
c:\program files\iLivid\VLC\http\images\playlist.png
c:\program files\iLivid\VLC\http\images\playlist_small.png
c:\program files\iLivid\VLC\http\images\plus.png
c:\program files\iLivid\VLC\http\images\prev.png
c:\program files\iLivid\VLC\http\images\refresh.png
c:\program files\iLivid\VLC\http\images\repeat.png
c:\program files\iLivid\VLC\http\images\sd.png
c:\program files\iLivid\VLC\http\images\shuffle.png
c:\program files\iLivid\VLC\http\images\slider_bar.png
c:\program files\iLivid\VLC\http\images\slider_left.png
c:\program files\iLivid\VLC\http\images\slider_point.png
c:\program files\iLivid\VLC\http\images\slider_right.png
c:\program files\iLivid\VLC\http\images\slow.png
c:\program files\iLivid\VLC\http\images\snapshot.png
c:\program files\iLivid\VLC\http\images\sort.png
c:\program files\iLivid\VLC\http\images\sout.png
c:\program files\iLivid\VLC\http\images\speaker.png
c:\program files\iLivid\VLC\http\images\speaker_mute.png
c:\program files\iLivid\VLC\http\images\stop.png
c:\program files\iLivid\VLC\http\images\vlc16x16.png
c:\program files\iLivid\VLC\http\images\volume_down.png
c:\program files\iLivid\VLC\http\images\volume_up.png
c:\program files\iLivid\VLC\http\images\white.png
c:\program files\iLivid\VLC\http\images\white_cross_small.png
c:\program files\iLivid\VLC\http\index.html
c:\program files\iLivid\VLC\http\js\functions.js
c:\program files\iLivid\VLC\http\js\mosaic.js
c:\program files\iLivid\VLC\http\js\vlm.js
c:\program files\iLivid\VLC\http\mosaic.html
c:\program files\iLivid\VLC\http\requests\browse.xml
c:\program files\iLivid\VLC\http\requests\playlist.xml
c:\program files\iLivid\VLC\http\requests\readme.txt
c:\program files\iLivid\VLC\http\requests\status.xml
c:\program files\iLivid\VLC\http\requests\vlm.xml
c:\program files\iLivid\VLC\http\requests\vlm_cmd.xml
c:\program files\iLivid\VLC\http\style.css
c:\program files\iLivid\VLC\http\vlm.html
c:\program files\iLivid\VLC\http\vlm_export.html
c:\program files\iLivid\VLC\languages\bengali.nsh
c:\program files\iLivid\VLC\languages\brazilian_portuguese.nsh
c:\program files\iLivid\VLC\languages\bulgarian.nsh
c:\program files\iLivid\VLC\languages\catalan.nsh
c:\program files\iLivid\VLC\languages\danish.nsh
c:\program files\iLivid\VLC\languages\declaration.nsh
c:\program files\iLivid\VLC\languages\dutch.nsh
c:\program files\iLivid\VLC\languages\english.nsh
c:\program files\iLivid\VLC\languages\estonian.nsh
c:\program files\iLivid\VLC\languages\finnish.nsh
c:\program files\iLivid\VLC\languages\french.nsh
c:\program files\iLivid\VLC\languages\german.nsh
c:\program files\iLivid\VLC\languages\hungarian.nsh
c:\program files\iLivid\VLC\languages\italian.nsh
c:\program files\iLivid\VLC\languages\japanese.nsh
c:\program files\iLivid\VLC\languages\lithuanian.nsh
c:\program files\iLivid\VLC\languages\occitan.nsh
c:\program files\iLivid\VLC\languages\polish.nsh
c:\program files\iLivid\VLC\languages\punjabi.nsh
c:\program files\iLivid\VLC\languages\romanian.nsh
c:\program files\iLivid\VLC\languages\schinese.nsh
c:\program files\iLivid\VLC\languages\slovak.nsh
c:\program files\iLivid\VLC\languages\slovenian.nsh
c:\program files\iLivid\VLC\languages\sorani.nsh
c:\program files\iLivid\VLC\languages\spanish.nsh
c:\program files\iLivid\VLC\libvlc.dll
c:\program files\iLivid\VLC\libvlc.dll.manifest
c:\program files\iLivid\VLC\libvlccore.dll
c:\program files\iLivid\VLC\locale\af\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ar\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\be\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\bg\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\bn\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ca\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ckb\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\co\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\cs\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\da\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\de\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\el\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\en_GB\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\es\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\et\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\eu\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\fa\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\fi\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\fr\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\fur\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\gl\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\he\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\hi\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\hr\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\hu\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\id\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\it\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ja\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ka\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\kk\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\km\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ko\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\lt\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\lv\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\mk\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ml\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\mn\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ms\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\my\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\nb\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ne\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\nl\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\nn\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\oc\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\pa\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\pl\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ps\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ro\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ru\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\si\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\sk\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\sl\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\sq\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\sr\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\sv\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\ta\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\tet\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\th\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\tl\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\tr\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\uk\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\vi\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\wa\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo
c:\program files\iLivid\VLC\lua\extensions\allocine-fr.lua
c:\program files\iLivid\VLC\lua\extensions\README.txt
c:\program files\iLivid\VLC\lua\http\.hosts
c:\program files\iLivid\VLC\lua\http\custom.lua
c:\program files\iLivid\VLC\lua\http\dialogs\.hosts
c:\program files\iLivid\VLC\lua\http\dialogs\browse
c:\program files\iLivid\VLC\lua\http\dialogs\footer
c:\program files\iLivid\VLC\lua\http\dialogs\input
c:\program files\iLivid\VLC\lua\http\dialogs\main
c:\program files\iLivid\VLC\lua\http\dialogs\mosaic
c:\program files\iLivid\VLC\lua\http\dialogs\playlist
c:\program files\iLivid\VLC\lua\http\dialogs\sout
c:\program files\iLivid\VLC\lua\http\dialogs\vlm
c:\program files\iLivid\VLC\lua\http\favicon.ico
c:\program files\iLivid\VLC\lua\http\flash.html
c:\program files\iLivid\VLC\lua\http\iehacks.css
c:\program files\iLivid\VLC\lua\http\images\delete.png
c:\program files\iLivid\VLC\lua\http\images\delete_small.png
c:\program files\iLivid\VLC\lua\http\images\eject.png
c:\program files\iLivid\VLC\lua\http\images\empty.png
c:\program files\iLivid\VLC\lua\http\images\fullscreen.png
c:\program files\iLivid\VLC\lua\http\images\help.png
c:\program files\iLivid\VLC\lua\http\images\info.png
c:\program files\iLivid\VLC\lua\http\images\loop.png
c:\program files\iLivid\VLC\lua\http\images\minus.png
c:\program files\iLivid\VLC\lua\http\images\next.png
c:\program files\iLivid\VLC\lua\http\images\pause.png
c:\program files\iLivid\VLC\lua\http\images\play.png
c:\program files\iLivid\VLC\lua\http\images\playlist.png
c:\program files\iLivid\VLC\lua\http\images\playlist_small.png
c:\program files\iLivid\VLC\lua\http\images\plus.png
c:\program files\iLivid\VLC\lua\http\images\prev.png
c:\program files\iLivid\VLC\lua\http\images\refresh.png
c:\program files\iLivid\VLC\lua\http\images\repeat.png
c:\program files\iLivid\VLC\lua\http\images\reset.png
c:\program files\iLivid\VLC\lua\http\images\sd.png
c:\program files\iLivid\VLC\lua\http\images\shuffle.png
c:\program files\iLivid\VLC\lua\http\images\slider_bar.png
c:\program files\iLivid\VLC\lua\http\images\slider_left.png
c:\program files\iLivid\VLC\lua\http\images\slider_point.png
c:\program files\iLivid\VLC\lua\http\images\slider_right.png
c:\program files\iLivid\VLC\lua\http\images\slow.png
c:\program files\iLivid\VLC\lua\http\images\snapshot.png
c:\program files\iLivid\VLC\lua\http\images\sort.png
c:\program files\iLivid\VLC\lua\http\images\sout.png
c:\program files\iLivid\VLC\lua\http\images\speaker.png
c:\program files\iLivid\VLC\lua\http\images\speaker_mute.png
c:\program files\iLivid\VLC\lua\http\images\stop.png
c:\program files\iLivid\VLC\lua\http\images\vlc16x16.png
c:\program files\iLivid\VLC\lua\http\images\volume_down.png
c:\program files\iLivid\VLC\lua\http\images\volume_up.png
c:\program files\iLivid\VLC\lua\http\images\white.png
c:\program files\iLivid\VLC\lua\http\images\white_cross_small.png
c:\program files\iLivid\VLC\lua\http\index.html
c:\program files\iLivid\VLC\lua\http\js\functions.js
c:\program files\iLivid\VLC\lua\http\js\mosaic.js
c:\program files\iLivid\VLC\lua\http\js\vlm.js
c:\program files\iLivid\VLC\lua\http\mosaic.html
c:\program files\iLivid\VLC\lua\http\requests\browse.xml
c:\program files\iLivid\VLC\lua\http\requests\playlist.xml
c:\program files\iLivid\VLC\lua\http\requests\readme.txt
c:\program files\iLivid\VLC\lua\http\requests\status.xml
c:\program files\iLivid\VLC\lua\http\requests\vlm.xml
c:\program files\iLivid\VLC\lua\http\requests\vlm_cmd.xml
c:\program files\iLivid\VLC\lua\http\style.css
c:\program files\iLivid\VLC\lua\http\vlm.html
c:\program files\iLivid\VLC\lua\http\vlm_export.html
c:\program files\iLivid\VLC\lua\intf\dummy.lua
c:\program files\iLivid\VLC\lua\intf\dumpmeta.lua
c:\program files\iLivid\VLC\lua\intf\hotkeys.lua
c:\program files\iLivid\VLC\lua\intf\http.lua
c:\program files\iLivid\VLC\lua\intf\luac.lua
c:\program files\iLivid\VLC\lua\intf\modules\common.lua
c:\program files\iLivid\VLC\lua\intf\modules\host.lua
c:\program files\iLivid\VLC\lua\intf\rc.lua
c:\program files\iLivid\VLC\lua\intf\README.txt
c:\program files\iLivid\VLC\lua\intf\telnet.lua
c:\program files\iLivid\VLC\lua\meta\art\01_googleimage.lua
c:\program files\iLivid\VLC\lua\meta\art\02_frenchtv.lua
c:\program files\iLivid\VLC\lua\meta\art\03_lastfm.lua
c:\program files\iLivid\VLC\lua\meta\art\04_musicbrainz.lua
c:\program files\iLivid\VLC\lua\meta\art\README.txt
c:\program files\iLivid\VLC\lua\meta\fetcher\README.txt
c:\program files\iLivid\VLC\lua\meta\fetcher\tvrage.lua
c:\program files\iLivid\VLC\lua\meta\reader\filename.lua
c:\program files\iLivid\VLC\lua\meta\reader\README.txt
c:\program files\iLivid\VLC\lua\modules\sandbox.lua
c:\program files\iLivid\VLC\lua\modules\simplexml.lua
c:\program files\iLivid\VLC\lua\playlist\anevia_streams.lua
c:\program files\iLivid\VLC\lua\playlist\anevia_xml.lua
c:\program files\iLivid\VLC\lua\playlist\appletrailers.lua
c:\program files\iLivid\VLC\lua\playlist\bbc_co_uk.lua
c:\program files\iLivid\VLC\lua\playlist\break.lua
c:\program files\iLivid\VLC\lua\playlist\canalplus.lua
c:\program files\iLivid\VLC\lua\playlist\cue.lua
c:\program files\iLivid\VLC\lua\playlist\dailymotion.lua
c:\program files\iLivid\VLC\lua\playlist\france2.lua
c:\program files\iLivid\VLC\lua\playlist\googlevideo.lua
c:\program files\iLivid\VLC\lua\playlist\jamendo.lua
c:\program files\iLivid\VLC\lua\playlist\joox.lua
c:\program files\iLivid\VLC\lua\playlist\katsomo.lua
c:\program files\iLivid\VLC\lua\playlist\koreus.lua
c:\program files\iLivid\VLC\lua\playlist\lelombrik.lua
c:\program files\iLivid\VLC\lua\playlist\megavideo.lua
c:\program files\iLivid\VLC\lua\playlist\metacafe.lua
c:\program files\iLivid\VLC\lua\playlist\mpora.lua
c:\program files\iLivid\VLC\lua\playlist\pinkbike.lua
c:\program files\iLivid\VLC\lua\playlist\README.txt
c:\program files\iLivid\VLC\lua\playlist\rockbox_fm_presets.lua
c:\program files\iLivid\VLC\lua\playlist\vimeo.lua
c:\program files\iLivid\VLC\lua\playlist\youtube.lua
c:\program files\iLivid\VLC\lua\playlist\youtube_homepage.lua
c:\program files\iLivid\VLC\lua\README.txt
c:\program files\iLivid\VLC\lua\sd\fmc.lua
c:\program files\iLivid\VLC\lua\sd\freebox.lua
c:\program files\iLivid\VLC\lua\sd\icecast.lua
c:\program files\iLivid\VLC\lua\sd\jamendo.lua
c:\program files\iLivid\VLC\lua\sd\README.txt
c:\program files\iLivid\VLC\mozilla\npvlc.dll
c:\program files\iLivid\VLC\mozilla\npvlc.dll.manifest
c:\program files\iLivid\VLC\NEWS.txt
c:\program files\iLivid\VLC\NSIS\UAC.dll
c:\program files\iLivid\VLC\NSIS\UAC.nsh
c:\program files\iLivid\VLC\osdmenu\default.cfg
c:\program files\iLivid\VLC\osdmenu\default\selected\bw.png
c:\program files\iLivid\VLC\osdmenu\default\selected\esc.png
c:\program files\iLivid\VLC\osdmenu\default\selected\fw.png
c:\program files\iLivid\VLC\osdmenu\default\selected\next.png
c:\program files\iLivid\VLC\osdmenu\default\selected\play_pause.png
c:\program files\iLivid\VLC\osdmenu\default\selected\previous.png
c:\program files\iLivid\VLC\osdmenu\default\selected\stop.png
c:\program files\iLivid\VLC\osdmenu\default\selected\volume.png
c:\program files\iLivid\VLC\osdmenu\default\selection\bw.png
c:\program files\iLivid\VLC\osdmenu\default\selection\esc.png
c:\program files\iLivid\VLC\osdmenu\default\selection\fw.png
c:\program files\iLivid\VLC\osdmenu\default\selection\next.png
c:\program files\iLivid\VLC\osdmenu\default\selection\play_pause.png
c:\program files\iLivid\VLC\osdmenu\default\selection\previous.png
c:\program files\iLivid\VLC\osdmenu\default\selection\stop.png
c:\program files\iLivid\VLC\osdmenu\default\selection\volume.png
c:\program files\iLivid\VLC\osdmenu\default\unselected.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_00.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_01.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_02.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_03.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_04.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_05.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_06.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_07.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_08.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_09.png
c:\program files\iLivid\VLC\osdmenu\default\volume\volume_10.png
c:\program files\iLivid\VLC\plugins\liba52_plugin.dll
c:\program files\iLivid\VLC\plugins\liba52tofloat32_plugin.dll
c:\program files\iLivid\VLC\plugins\liba52tospdif_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_attachment_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_bd_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_fake_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_ftp_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_http_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_imem_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_mms_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_output_dummy_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_output_file_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_output_http_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_output_shout_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_output_udp_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_realrtsp_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_smb_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_tcp_plugin.dll
c:\program files\iLivid\VLC\plugins\libaccess_udp_plugin.dll
c:\program files\iLivid\VLC\plugins\libadjust_plugin.dll
c:\program files\iLivid\VLC\plugins\libadpcm_plugin.dll
c:\program files\iLivid\VLC\plugins\libaes3_plugin.dll
c:\program files\iLivid\VLC\plugins\libaiff_plugin.dll
c:\program files\iLivid\VLC\plugins\libalphamask_plugin.dll
c:\program files\iLivid\VLC\plugins\libaout_directx_plugin.dll
c:\program files\iLivid\VLC\plugins\libaout_file_plugin.dll
c:\program files\iLivid\VLC\plugins\libaout_sdl_plugin.dll
c:\program files\iLivid\VLC\plugins\libaraw_plugin.dll
c:\program files\iLivid\VLC\plugins\libasf_plugin.dll
c:\program files\iLivid\VLC\plugins\libatmo_plugin.dll
c:\program files\iLivid\VLC\plugins\libau_plugin.dll
c:\program files\iLivid\VLC\plugins\libaudio_format_plugin.dll
c:\program files\iLivid\VLC\plugins\libaudiobargraph_a_plugin.dll
c:\program files\iLivid\VLC\plugins\libaudiobargraph_v_plugin.dll
c:\program files\iLivid\VLC\plugins\libaudioscrobbler_plugin.dll
c:\program files\iLivid\VLC\plugins\libavcodec_plugin.dll
c:\program files\iLivid\VLC\plugins\libavi_plugin.dll
c:\program files\iLivid\VLC\plugins\libball_plugin.dll
c:\program files\iLivid\VLC\plugins\libbandlimited_resampler_plugin.dll
c:\program files\iLivid\VLC\plugins\libbda_plugin.dll
c:\program files\iLivid\VLC\plugins\libblend_plugin.dll
c:\program files\iLivid\VLC\plugins\libblendbench_plugin.dll
c:\program files\iLivid\VLC\plugins\libbluescreen_plugin.dll
c:\program files\iLivid\VLC\plugins\libcaca_plugin.dll
c:\program files\iLivid\VLC\plugins\libcanvas_plugin.dll
c:\program files\iLivid\VLC\plugins\libcc_plugin.dll
c:\program files\iLivid\VLC\plugins\libcdda_plugin.dll
c:\program files\iLivid\VLC\plugins\libcdg_plugin.dll
c:\program files\iLivid\VLC\plugins\libchain_plugin.dll
c:\program files\iLivid\VLC\plugins\libchorus_flanger_plugin.dll
c:\program files\iLivid\VLC\plugins\libclone_plugin.dll
c:\program files\iLivid\VLC\plugins\libcolorthres_plugin.dll
c:\program files\iLivid\VLC\plugins\libconverter_fixed_plugin.dll
c:\program files\iLivid\VLC\plugins\libcrop_plugin.dll
c:\program files\iLivid\VLC\plugins\libcroppadd_plugin.dll
c:\program files\iLivid\VLC\plugins\libcvdsub_plugin.dll
c:\program files\iLivid\VLC\plugins\libdeinterlace_plugin.dll
c:\program files\iLivid\VLC\plugins\libdemux_cdg_plugin.dll
c:\program files\iLivid\VLC\plugins\libdemuxdump_plugin.dll
c:\program files\iLivid\VLC\plugins\libdirac_plugin.dll
c:\program files\iLivid\VLC\plugins\libdirect3d_plugin.dll
c:\program files\iLivid\VLC\plugins\libdirectx_plugin.dll
c:\program files\iLivid\VLC\plugins\libdmo_plugin.dll
c:\program files\iLivid\VLC\plugins\libdolby_surround_decoder_plugin.dll
c:\program files\iLivid\VLC\plugins\libdrawable_plugin.dll
c:\program files\iLivid\VLC\plugins\libdshow_plugin.dll
c:\program files\iLivid\VLC\plugins\libdts_plugin.dll
c:\program files\iLivid\VLC\plugins\libdtstofloat32_plugin.dll
c:\program files\iLivid\VLC\plugins\libdtstospdif_plugin.dll
c:\program files\iLivid\VLC\plugins\libdummy_plugin.dll
c:\program files\iLivid\VLC\plugins\libdvbsub_plugin.dll
c:\program files\iLivid\VLC\plugins\libdvdnav_plugin.dll
c:\program files\iLivid\VLC\plugins\libdvdread_plugin.dll
c:\program files\iLivid\VLC\plugins\libequalizer_plugin.dll
c:\program files\iLivid\VLC\plugins\liberase_plugin.dll
c:\program files\iLivid\VLC\plugins\libes_plugin.dll
c:\program files\iLivid\VLC\plugins\libexport_plugin.dll
c:\program files\iLivid\VLC\plugins\libextract_plugin.dll
c:\program files\iLivid\VLC\plugins\libfaad_plugin.dll
c:\program files\iLivid\VLC\plugins\libfake_plugin.dll
c:\program files\iLivid\VLC\plugins\libfilesystem_plugin.dll
c:\program files\iLivid\VLC\plugins\libflac_plugin.dll
c:\program files\iLivid\VLC\plugins\libflacsys_plugin.dll
c:\program files\iLivid\VLC\plugins\libfloat32_mixer_plugin.dll
c:\program files\iLivid\VLC\plugins\libfluidsynth_plugin.dll
c:\program files\iLivid\VLC\plugins\libfolder_plugin.dll
c:\program files\iLivid\VLC\plugins\libfreetype_plugin.dll
c:\program files\iLivid\VLC\plugins\libgaussianblur_plugin.dll
c:\program files\iLivid\VLC\plugins\libgestures_plugin.dll
c:\program files\iLivid\VLC\plugins\libglobalhotkeys_plugin.dll
c:\program files\iLivid\VLC\plugins\libglwin32_plugin.dll
c:\program files\iLivid\VLC\plugins\libgnutls_plugin.dll
c:\program files\iLivid\VLC\plugins\libgoom_plugin.dll
c:\program files\iLivid\VLC\plugins\libgradient_plugin.dll
c:\program files\iLivid\VLC\plugins\libgrain_plugin.dll
c:\program files\iLivid\VLC\plugins\libgrey_yuv_plugin.dll
c:\program files\iLivid\VLC\plugins\libh264_plugin.dll
c:\program files\iLivid\VLC\plugins\libheadphone_channel_mixer_plugin.dll
c:\program files\iLivid\VLC\plugins\libhotkeys_plugin.dll
c:\program files\iLivid\VLC\plugins\libi420_rgb_mmx_plugin.dll
c:\program files\iLivid\VLC\plugins\libi420_rgb_plugin.dll
c:\program files\iLivid\VLC\plugins\libi420_rgb_sse2_plugin.dll
c:\program files\iLivid\VLC\plugins\libi420_yuy2_mmx_plugin.dll
c:\program files\iLivid\VLC\plugins\libi420_yuy2_plugin.dll
c:\program files\iLivid\VLC\plugins\libi420_yuy2_sse2_plugin.dll
c:\program files\iLivid\VLC\plugins\libi422_i420_plugin.dll
c:\program files\iLivid\VLC\plugins\libi422_yuy2_mmx_plugin.dll
c:\program files\iLivid\VLC\plugins\libi422_yuy2_plugin.dll
c:\program files\iLivid\VLC\plugins\libi422_yuy2_sse2_plugin.dll
c:\program files\iLivid\VLC\plugins\libinvert_plugin.dll
c:\program files\iLivid\VLC\plugins\libinvmem_plugin.dll
c:\program files\iLivid\VLC\plugins\libkate_plugin.dll
c:\program files\iLivid\VLC\plugins\liblibass_plugin.dll
c:\program files\iLivid\VLC\plugins\liblibmpeg2_plugin.dll
c:\program files\iLivid\VLC\plugins\liblive555_plugin.dll
c:\program files\iLivid\VLC\plugins\liblogger_plugin.dll
c:\program files\iLivid\VLC\plugins\liblogo_plugin.dll
c:\program files\iLivid\VLC\plugins\liblpcm_plugin.dll
c:\program files\iLivid\VLC\plugins\liblua_plugin.dll
c:\program files\iLivid\VLC\plugins\libmagnify_plugin.dll
c:\program files\iLivid\VLC\plugins\libmarq_plugin.dll
c:\program files\iLivid\VLC\plugins\libmediadirs_plugin.dll
c:\program files\iLivid\VLC\plugins\libmemcpy3dn_plugin.dll
c:\program files\iLivid\VLC\plugins\libmemcpymmx_plugin.dll
c:\program files\iLivid\VLC\plugins\libmemcpymmxext_plugin.dll
c:\program files\iLivid\VLC\plugins\libmirror_plugin.dll
c:\program files\iLivid\VLC\plugins\libmjpeg_plugin.dll
c:\program files\iLivid\VLC\plugins\libmkv_plugin.dll
c:\program files\iLivid\VLC\plugins\libmod_plugin.dll
c:\program files\iLivid\VLC\plugins\libmono_plugin.dll
c:\program files\iLivid\VLC\plugins\libmosaic_plugin.dll
c:\program files\iLivid\VLC\plugins\libmotionblur_plugin.dll
c:\program files\iLivid\VLC\plugins\libmotiondetect_plugin.dll
c:\program files\iLivid\VLC\plugins\libmp4_plugin.dll
c:\program files\iLivid\VLC\plugins\libmpeg_audio_plugin.dll
c:\program files\iLivid\VLC\plugins\libmpgatofixed32_plugin.dll
c:\program files\iLivid\VLC\plugins\libmpgv_plugin.dll
c:\program files\iLivid\VLC\plugins\libmsn_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_asf_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_avi_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_dummy_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_mp4_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_mpjpeg_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_ogg_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_ps_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_ts_plugin.dll
c:\program files\iLivid\VLC\plugins\libmux_wav_plugin.dll
c:\program files\iLivid\VLC\plugins\libnetsync_plugin.dll
c:\program files\iLivid\VLC\plugins\libnoise_plugin.dll
c:\program files\iLivid\VLC\plugins\libnormvol_plugin.dll
c:\program files\iLivid\VLC\plugins\libnsc_plugin.dll
c:\program files\iLivid\VLC\plugins\libnsv_plugin.dll
c:\program files\iLivid\VLC\plugins\libntservice_plugin.dll
c:\program files\iLivid\VLC\plugins\libnuv_plugin.dll
c:\program files\iLivid\VLC\plugins\libogg_plugin.dll
c:\program files\iLivid\VLC\plugins\liboldhttp_plugin.dll
c:\program files\iLivid\VLC\plugins\liboldrc_plugin.dll
c:\program files\iLivid\VLC\plugins\liboldtelnet_plugin.dll
c:\program files\iLivid\VLC\plugins\libosd_parser_plugin.dll
c:\program files\iLivid\VLC\plugins\libosdmenu_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_copy_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_dirac_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_flac_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_h264_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_mlp_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_mpeg4audio_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_mpeg4video_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_mpegvideo_plugin.dll
c:\program files\iLivid\VLC\plugins\libpacketizer_vc1_plugin.dll
c:\program files\iLivid\VLC\plugins\libpanoramix_plugin.dll
c:\program files\iLivid\VLC\plugins\libparam_eq_plugin.dll
c:\program files\iLivid\VLC\plugins\libplaylist_plugin.dll
c:\program files\iLivid\VLC\plugins\libpng_plugin.dll
c:\program files\iLivid\VLC\plugins\libpodcast_plugin.dll
c:\program files\iLivid\VLC\plugins\libportaudio_plugin.dll
c:\program files\iLivid\VLC\plugins\libpostproc_plugin.dll
c:\program files\iLivid\VLC\plugins\libps_plugin.dll
c:\program files\iLivid\VLC\plugins\libpsychedelic_plugin.dll
c:\program files\iLivid\VLC\plugins\libpuzzle_plugin.dll
c:\program files\iLivid\VLC\plugins\libpva_plugin.dll
c:\program files\iLivid\VLC\plugins\libqt4_plugin.dll
c:\program files\iLivid\VLC\plugins\libquicktime_plugin.dll
c:\program files\iLivid\VLC\plugins\librawaud_plugin.dll
c:\program files\iLivid\VLC\plugins\librawdv_plugin.dll
c:\program files\iLivid\VLC\plugins\librawvid_plugin.dll
c:\program files\iLivid\VLC\plugins\librawvideo_plugin.dll
c:\program files\iLivid\VLC\plugins\libreal_plugin.dll
c:\program files\iLivid\VLC\plugins\librealvideo_plugin.dll
c:\program files\iLivid\VLC\plugins\libremoteosd_plugin.dll
c:\program files\iLivid\VLC\plugins\libripple_plugin.dll
c:\program files\iLivid\VLC\plugins\librotate_plugin.dll
c:\program files\iLivid\VLC\plugins\librss_plugin.dll
c:\program files\iLivid\VLC\plugins\librtp_plugin.dll
c:\program files\iLivid\VLC\plugins\librv32_plugin.dll
c:\program files\iLivid\VLC\plugins\libsap_plugin.dll
c:\program files\iLivid\VLC\plugins\libscale_plugin.dll
c:\program files\iLivid\VLC\plugins\libscaletempo_plugin.dll
c:\program files\iLivid\VLC\plugins\libscene_plugin.dll
c:\program files\iLivid\VLC\plugins\libschroedinger_plugin.dll
c:\program files\iLivid\VLC\plugins\libscreen_plugin.dll
c:\program files\iLivid\VLC\plugins\libsdl_image_plugin.dll
c:\program files\iLivid\VLC\plugins\libsharpen_plugin.dll
c:\program files\iLivid\VLC\plugins\libsimple_channel_mixer_plugin.dll
c:\program files\iLivid\VLC\plugins\libskins2_plugin.dll
c:\program files\iLivid\VLC\plugins\libsmf_plugin.dll
c:\program files\iLivid\VLC\plugins\libspatializer_plugin.dll
c:\program files\iLivid\VLC\plugins\libspdif_mixer_plugin.dll
c:\program files\iLivid\VLC\plugins\libspeex_plugin.dll
c:\program files\iLivid\VLC\plugins\libspudec_plugin.dll
c:\program files\iLivid\VLC\plugins\libstats_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_filter_rar_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_filter_record_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_autodel_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_bridge_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_description_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_display_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_dummy_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_duplicate_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_es_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_gather_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_mosaic_bridge_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_raop_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_record_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_rtp_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_smem_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_standard_plugin.dll
c:\program files\iLivid\VLC\plugins\libstream_out_transcode_plugin.dll
c:\program files\iLivid\VLC\plugins\libsubsdec_plugin.dll
c:\program files\iLivid\VLC\plugins\libsubsusf_plugin.dll
c:\program files\iLivid\VLC\plugins\libsubtitle_plugin.dll
c:\program files\iLivid\VLC\plugins\libsvcdsub_plugin.dll
c:\program files\iLivid\VLC\plugins\libswscale_plugin.dll
c:\program files\iLivid\VLC\plugins\libt140_plugin.dll
c:\program files\iLivid\VLC\plugins\libtaglib_plugin.dll
c:\program files\iLivid\VLC\plugins\libtheora_plugin.dll
c:\program files\iLivid\VLC\plugins\libtransform_plugin.dll
c:\program files\iLivid\VLC\plugins\libtrivial_channel_mixer_plugin.dll
c:\program files\iLivid\VLC\plugins\libtrivial_mixer_plugin.dll
c:\program files\iLivid\VLC\plugins\libts_plugin.dll
c:\program files\iLivid\VLC\plugins\libtta_plugin.dll
c:\program files\iLivid\VLC\plugins\libtwolame_plugin.dll
c:\program files\iLivid\VLC\plugins\libty_plugin.dll
c:\program files\iLivid\VLC\plugins\libugly_resampler_plugin.dll
c:\program files\iLivid\VLC\plugins\libvc1_plugin.dll
c:\program files\iLivid\VLC\plugins\libvcd_plugin.dll
c:\program files\iLivid\VLC\plugins\libvideo_filter_wrapper_plugin.dll
c:\program files\iLivid\VLC\plugins\libvisual_plugin.dll
c:\program files\iLivid\VLC\plugins\libvmem_plugin.dll
c:\program files\iLivid\VLC\plugins\libvobsub_plugin.dll
c:\program files\iLivid\VLC\plugins\libvoc_plugin.dll
c:\program files\iLivid\VLC\plugins\libvod_rtsp_plugin.dll
c:\program files\iLivid\VLC\plugins\libvorbis_plugin.dll
c:\program files\iLivid\VLC\plugins\libvout_sdl_plugin.dll
c:\program files\iLivid\VLC\plugins\libvout_wrapper_plugin.dll
c:\program files\iLivid\VLC\plugins\libwall_plugin.dll
c:\program files\iLivid\VLC\plugins\libwav_plugin.dll
c:\program files\iLivid\VLC\plugins\libwave_plugin.dll
c:\program files\iLivid\VLC\plugins\libwaveout_plugin.dll
c:\program files\iLivid\VLC\plugins\libwingdi_plugin.dll
c:\program files\iLivid\VLC\plugins\libx264_plugin.dll
c:\program files\iLivid\VLC\plugins\libxa_plugin.dll
c:\program files\iLivid\VLC\plugins\libxml_plugin.dll
c:\program files\iLivid\VLC\plugins\libxtag_plugin.dll
c:\program files\iLivid\VLC\plugins\libyuv_plugin.dll
c:\program files\iLivid\VLC\plugins\libyuvp_plugin.dll
c:\program files\iLivid\VLC\plugins\libyuy2_i420_plugin.dll
c:\program files\iLivid\VLC\plugins\libyuy2_i422_plugin.dll
c:\program files\iLivid\VLC\plugins\libzip_plugin.dll
c:\program files\iLivid\VLC\plugins\libzvbi_plugin.dll
c:\program files\iLivid\VLC\plugins\plugins-04041e-7e8.dat
c:\program files\iLivid\VLC\README.txt
c:\program files\iLivid\VLC\sdk\include\vlc\deprecated.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_events.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_media.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_media_discoverer.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_media_library.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_media_list.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_media_list_player.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_media_player.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_structures.h
c:\program files\iLivid\VLC\sdk\include\vlc\libvlc_vlm.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_access.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_acl.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_aout.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_aout_mixer.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_arrays.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_art_finder.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_avcodec.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_bits.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_block.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_block_helper.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_charset.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_codec.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_common.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_config.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_config_cat.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_configuration.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_cpu.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_demux.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_dialog.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_epg.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_es.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_es_out.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_events.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_filter.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_fourcc.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_fs.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_gcrypt.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_http.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_httpd.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_image.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_inhibit.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_input.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_input_item.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_main.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_md5.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_messages.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_meta.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_modules.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_mouse.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_mtime.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_objects.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_picture.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_picture_fifo.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_picture_pool.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_playlist.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_plugin.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_probe.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_rand.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_services_discovery.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_sout.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_sql.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_stream.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_strings.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_subpicture.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_threads.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_url.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_variables.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_video_splitter.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_vlm.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_vout.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_vout_display.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_vout_opengl.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_vout_window.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_xlib.h
c:\program files\iLivid\VLC\sdk\include\vlc\plugins\vlc_xml.h
c:\program files\iLivid\VLC\sdk\include\vlc\vlc.h
c:\program files\iLivid\VLC\sdk\lib\libvlc.dll.a
c:\program files\iLivid\VLC\sdk\lib\libvlc.la
c:\program files\iLivid\VLC\sdk\lib\libvlccore.dll.a
c:\program files\iLivid\VLC\sdk\lib\libvlccore.la
c:\program files\iLivid\VLC\sdk\lib\pkgconfig\libvlc.pc
c:\program files\iLivid\VLC\sdk\lib\pkgconfig\vlc-plugin.pc
c:\program files\iLivid\VLC\skins\default.vlt
c:\program files\iLivid\VLC\skins\fonts\FreeSans.ttf
c:\program files\iLivid\VLC\skins\fonts\FreeSansBold.ttf
c:\program files\iLivid\VLC\skins\skin.catalog
c:\program files\iLivid\VLC\skins\skin.dtd
c:\program files\iLivid\VLC\spad.nsi
c:\program files\iLivid\VLC\THANKS.txt
c:\program files\iLivid\VLC\vlc-cache-gen.exe
c:\program files\iLivid\VLC\vlc.exe
c:\program files\iLivid\VLC\vlc.exe.manifest
c:\program files\iLivid\VLC\vlc.ico
c:\program files\iLivid\VLC\vlc.win32.nsi
c:\program files\Windows iLivid Toolbar
c:\program files\Windows iLivid Toolbar\Datamngr\datamngr.dll
c:\program files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe
c:\program files\Windows iLivid Toolbar\ToolBar\as_guid.dat
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\bandoocode.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\data\search\engines.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\data\search\search.xsl
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\imeshcode.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\about.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\bandoocode.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\dtxpanel.xul
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\dtxpanelwin.xul
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\dtxprefwin.xul
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\dtxtransparentwin.xul
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\dtxwin.xul
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\emailnotifierproviders.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\external.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\imeshcode.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\neterror.xhtml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\nsDragAndDrop.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\vmncode.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\lib\wmpstreamer.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\modules\datastore.jsm
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\neterror.xhtml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\partner.coupons.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\preferences.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\radiobeta.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\template.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\toolbar.htm
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\toolbar.xul
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\vmncode.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\vmnrsswin.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\alert_coupon.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\arrow-next-off.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\arrow-next.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\arrow-previous-off.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\arrow-previous.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\bg-coupon-blue.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\bg-save.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\btn-getcoupon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\btn-next-blue.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\btn-previous-blue.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\btn-wide-close-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\btn-wide-close.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\coupon-activated.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\couponTooltip.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\css\ie7style.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\ico-coupon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\ico-dollar.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\arrow-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\arrows_grey-left.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\arrows_grey-right.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\bg_top.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\btn-back.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\btn-getcoupon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\btn-search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\coupon-activated.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\delete.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\loader.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\scrollb-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\scrollb-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\scrollb.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\scrollt-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\scrollt-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\scrollt.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\sprite.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-arrow-hover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-arrow.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-off-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-off-l_BAK.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-off-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-off-r_BAK.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-on-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-on-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-over-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-over-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-white-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-white-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\tab-white-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images\vid-bg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\index.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\jquery.contextMenu.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\jquery.contextMenu.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\js\jquery-1.4.2.min.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\js\jquery.event.wheel.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\js\jquery.scrollTo-min.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\js\JSON.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\js\listnav.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\js\main.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\page_white_copy.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\panel.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\partner.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\placeholder-logo.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\bg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\btn-wide-close-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\btn-wide-close.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\default.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\transparent.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\win-btm-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\win-btm-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\win-btm-right-resize.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images\win-btm-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\main.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\scripts\defscript.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\tb_icon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\widget.jsw
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\widget.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\widget_version.txt
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\arrow-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\arrows_grey-left.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\arrows_grey-right.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\back.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\btn-search-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\btn-search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\delete.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\scrollb-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\scrollb-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\scrollb.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\scrollt-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\scrollt-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\scrollt.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-arrow-hover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-arrow.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-off-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-off-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-on-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-on-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-over-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-over-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-red-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-red-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-red-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-white-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-white-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\tab-white-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\throbber.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\vid-bg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images\youtube.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\index.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\js\function.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\js\jquery-1.4.2.min.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\js\JSON.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\bg-facebook.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\blank.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\btn-wide-close-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\btn-wide-close.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\default.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\transparent.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\win-btm-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\win-btm-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\win-btm-right-resize.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images\win-btm-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\main.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\scripts\defscript.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\scripts\jquery-1.4.2.min.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\tb_icon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\widget.jsw
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\widget.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\widget_version.txt
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.PPCBully\tb_icon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.PPCBully\widget.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.PPCBully\widget.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.PPCBully\widget_version
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\css\twitter.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\btn-login-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\btn-login.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\btn-submit.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\loginbg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\refresh-over.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\refresh.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrollbottom.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\scrolltop.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-off-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-off-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-on-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\tab-on-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\throbber.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\twitter-logo48.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\images\twitter_top.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\js\jquery.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\js\scripts.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\bg.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\btn-wide-close-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\btn-wide-close.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\default.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\transparent.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-right-resize.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\images\win-btm-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\main.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\skin\scripts\defscript.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\tb_icon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\widget.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\widget.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.Twitter\widget_version.txt
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\css\autocomplete.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\arrow-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\arrows_grey-left.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\arrows_grey-right.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\bg.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\btn-search-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\btn-search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\powered-by-youtube.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-off-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-off-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-on-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-on-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-red-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-red-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-red-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-white-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-white-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\tab-white-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\throbber.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\vid-bg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\images\youtube.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\index.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\js\autocomplete.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\js\jquery-1.4.3.min.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\js\paginator.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\js\youtube.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\bg.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\btn-search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\btn-wide-close-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\btn-wide-close.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\default.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\tab-off-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\tab-off-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\tab-on-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\tab-on-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\transparent.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\win-btm-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\win-btm-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\win-btm-right-resize.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images\win-btm-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\main.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\scripts\defscript.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\tb_icon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\widget.jsw
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\widget.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.YouTube_v2\widget_version.txt
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\babylon_logo.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\bandoo.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\bluelite.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\bluesky.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\btn-search-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\btn-search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\btn-settings-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\btn-settings.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\btn-widgets-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\btn-widgets.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\btn_settings.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\ca.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\dictionary.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\divider.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\downloadcom.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\dtxlogo.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\ebay.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\email.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\email_on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\facebook.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\games.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred0.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred0_5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred1.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred1_5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred2.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred2_5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred3.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred3_5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred4.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred4_5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphred5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\graphredna.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\grey.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\ico-shield.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\icon_radio_png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\icon_seperator_png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\images.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\imesh.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\add.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\aol.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\arrow-dn.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\arrow-right-disabled.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\arrow-right.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\arrow-up.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btn-divider.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btn-end.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btn-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btn-mdl_ff.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btn-start.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btnover-divider.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btnover-end.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btnover-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btnover-mdl_ff.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\bg-btnover-start.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\blank.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btn-widgets-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btn-widgets.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btn_slider.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btnback-down-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btnback-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btnleft-down-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btnleft-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btnright-down-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\btnright-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\button-splitter-down-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\button-splitter-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\checkmark.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\chevron.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\collapse.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\comcast.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\dtx.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\edit-back-hot.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\edit-back.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\expand.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\found.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\gmail.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\highlight.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\highlight_blue.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\highlight_cyan.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\highlight_lime.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\highlight_magenta.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\highlight_yellow.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\hotmail.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\ico-check.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\imap.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\lastsearch-thumb-back.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\loadingMid.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\lock.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\logo-separator.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\mailcom.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menu_bg-basic.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menu_separator_bar.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menu_separator_white.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menuitem-splitter.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menuitemback-down-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menuitemback-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menuitemleft-down-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menuitemleft-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menuitemright-down-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\menuitemright-vista.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\modify.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\move.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\movetarget.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\css\panels.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\css\popupAbout.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\css\popupGames.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\css\popupRSS.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\css\popupWidgets.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\css\dialog.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\bg.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\btn-search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\btn-wide-close-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\btn-wide-close.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\default.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\tab-off-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\tab-off-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\tab-on-l.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\tab-on-r.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\transparent.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\ttlbar-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\ttlbar-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\ttlbar-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\win-btm-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\win-btm-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\win-btm-right-resize.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\win-btm-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\win-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\images\win-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\main.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\default\scripts\defscript.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\footer.htm
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\gamecategory.xsl
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\gameData.js
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\gameList.xsl
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\games.xsl
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\gametype.xsl
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\arrow-dn.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\arrow-sml-drop.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\arrow-sml.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\arrow-up.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\arrowr-bluew5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\bg-aboutbox.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\bg-btnover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\bg-pnl520x390.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-addtoolbar-left-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-addtoolbar-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-addtoolbar-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-back.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-close-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-close-greyover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-drag.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-mdl-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-mdl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-moredetails.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-next-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-next.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-play-left-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-play-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-previous-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-previous.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-right-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-search-pnlbtm-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-search-pnlbtm.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-try-left-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\btn-try-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\bullet-orange.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\gamethumb-on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\gamethumb2-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\ico-calendar.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\ico-dollar.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\ico-download.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\ico-joystick24.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\ico-news24.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\ico-play.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\ico-tags.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\icon-Add.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\icon-download.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\icon-Info.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\icon-play.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\icon-shop.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\menul-bgon.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\menul-bgover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\panel-botm-noscroll.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scroll-bg-206.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scroll-bg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scroll-topwin.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollb-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollb-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollb-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollb.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollt-disable.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollt-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollt-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\scrollt.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\searchbox-pnlbtm.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\star_x_grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\star_x_orange.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\TRUSTe_about.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\view-detailed-on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\view-detailed-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\view-thumb-on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\view-thumb-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\widgets-square-16px.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\widgets-square-24px.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\images\widgets.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\initHTML.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\popupGames.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\popupHTML.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\popupRSS.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\popupWidgets.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\panels\scroll.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\pop.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\css\manager.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\css\slider.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\bg-pnl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\btn-close-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\btn-close-greyover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\collapsed_button.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\expanded_button.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\ico-playstation-down.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\ico-playstation-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\ico-playstation.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\ico-radio.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\music-note.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-btn-pause-on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-btn-pause.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-btn-play-on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-btn-play.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-eq-bg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-eq-buffer.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-eq-busy.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-eq-off.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-eq-on.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-eq-warning.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-options-design-on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-options-design.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-options-on.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-options.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-volume-0.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-volume-1.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-volume-2.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-volume-3.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\radio-volume-mute.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\scrollbar-handle.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\scrollbar-track.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\slider.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\slideron.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\images\track.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\managerpanel.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radio\volumeslider.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radiobeta-buffering.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radiobeta-connecting.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radiobeta-playing.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radiobeta-stopped.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\radiobeta.ico
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\reload.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\remove.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\rename.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\resize-box.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\rss.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\rsschannelback.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\RSSLogo.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\rsstabdivider.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\scroll-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\scroll-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\search-go.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\text-ellipsis.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\throbber.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\toolbarsplitter.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\transparent_1px.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_02.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_03.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_04.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_06.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_07.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_08.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_09.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_10.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_11.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_12.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_13.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_14.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_15.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_16.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_18.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_19.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_20.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\border_21.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\btn-close-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\btn-close-greyover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\close-hot.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\close-normal.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\loadingMid.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\proxy.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\template.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\template.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\templateFF.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\uwa\throbber.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\icons\cond999.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\icons\icons.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\icons\na-s.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\icons\na-t.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\icons\na.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\add.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\arrowr-bluew5.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue-whitebg.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\box-check.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-close-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-delete.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next-off.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous-off.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\ico-check.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid-s.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\options-weather.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\over-blue.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\over-orange.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug2.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\radio-unchecked.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\searchbox-pnlbtm.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\popupWeather.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\popupWeather.html
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lib\yahoo.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\lichen.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\logo-about.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\logo-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\logo-separator.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\logo.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\mail.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\maps.bmp
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\menuseparatorback.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\modify-save.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\modify.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\modifyhot.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\music.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\news.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\options\options-main.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\options\options-search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\options\options-weather.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\options\options-weather.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\options\options-widgets.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\orange.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\pixsy.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\protect-id.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\radiobeta-buffering.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\radiobeta-connecting.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\radiobeta-playing.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\radiobeta-stopped.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\radiobeta.ico
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\relatedlinks.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-collapse.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-delete.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-expand.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-feed.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-folder-remove.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-folder-rename.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-folder.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-found.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-reload.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss-subscribe.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rss.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rssback.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\rsstopback.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\search-over.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\search.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\search_button_over_png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\search_button_png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\searchbar\searchbar-background-left.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\searchbar\searchbar-background-middle.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\searchbar\searchbar-background-right.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\settings.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\shopping.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\siteinfo.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\skin-bluelite.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\skin-bluesky.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\skin-grey.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\skin-lichen.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\skin-orange.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\skin-yellow.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\skin.xml
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\technorati.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\throbber.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\toolbarsplitter.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\translate.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\video.bmp
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\vmn.css
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\vmn.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\weather.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\web.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\widgets-square-16px.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\wikipedia.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\yahoosearch.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\yellow.gif
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\youtube.png
c:\program files\Windows iLivid Toolbar\ToolBar\chrome\skin\zoom.png
c:\program files\Windows iLivid Toolbar\ToolBar\components\windowmediator.js
c:\program files\Windows iLivid Toolbar\ToolBar\dtUser.exe
c:\program files\Windows iLivid Toolbar\ToolBar\manifest.xml
c:\program files\Windows iLivid Toolbar\ToolBar\searchquband.dll
c:\program files\Windows iLivid Toolbar\ToolBar\uninstall.exe
c:\program files\Windows iLivid Toolbar\uninstall.exe
.
—– BITS: Possible infected sites —–
.
hxxp://buy-download.norton.com
.
((((((((((((((((((((((((( Files Created from 2011-04-16 to 2011-05-16 )))))))))))))))))))))))))))))))
.
.
2011-05-12 21:59 . 2011-05-12 21:59 ——– d-sh–w- c:\windows\system32\AI_RecycleBin
2011-05-12 21:59 . 2011-05-12 21:59 ——– d—–w- c:\program files\W3i
2011-05-11 21:08 . 2011-05-11 21:18 ——– dc-h–w- c:\windows\ie8
2011-05-11 13:22 . 2011-05-11 13:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\vlc
2011-04-19 23:03 . 2011-04-19 23:03 ——– d—–w- c:\program files\iPod
2011-04-19 23:03 . 2011-04-19 23:03 ——– d—–w- c:\program files\iTunes
2011-04-19 23:00 . 2011-04-19 23:00 ——– d—–w- c:\program files\Bonjour
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-06 21:20 . 2011-04-06 21:20 91424 —-a-w- c:\windows\system32\dnssd.dll
2011-04-06 21:20 . 2011-04-06 21:20 107808 —-a-w- c:\windows\system32\dns-sd.exe
2011-03-07 05:33 . 2008-04-14 12:41 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 16:50 . 2011-03-04 16:50 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2011-03-04 16:50 . 2011-03-04 16:50 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-03-04 06:37 . 2008-04-14 12:42 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2008-04-14 08:00 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2008-04-14 12:42 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 23:06 . 2008-04-14 12:42 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2008-04-14 12:41 43520 ——w- c:\windows\system32\licmgr10.dll
2011-02-22 11:41 . 2008-04-14 07:07 385024 ——w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2008-04-14 07:47 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2008-04-14 07:45 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2010-04-06 15:38 5120 —-a-w- c:\windows\system32\xpsp4res.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Starfield Updater"="c:\program files\Starfield\WorkspaceUpdate.exe" [2011-03-14 33984]
"NortonUpdateAgent"="c:\documents and settings\All Users\Application Data\Norton\NUA.exe" [2011-04-05 2692024]
"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-05-10 1205760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-04-07 318488]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]
"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2010-08-09 1394440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2011-5-6 5794648]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2010-8-25 1156384]
QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks Enterprise Solutions 9.0\QBW32.EXE [2010-8-25 1178400]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-12-08 19:11 87424 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Web Connector.lnk]
backup=c:\windows\pss\QuickBooks Web Connector.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2010-09-22 23:11 640440 —-a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2011-01-31 06:36 38840 —-a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 12:58 611712 —-a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-04-20 17:48 58656 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 16:32 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 21:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetRefresh]
2003-11-20 19:01 525824 —-a-w- c:\program files\Compaq\SetRefresh\SetRefresh.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\Intuit\\QuickBooks Enterprise Solutions 9.0\\QBDBMgrN.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\symds.sys [3/5/2011 2:50 AM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\symefa.sys [3/5/2011 2:50 AM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110430.001\BHDrvx86.sys [5/2/2011 4:48 PM 802936]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\cchpx86.sys [3/5/2011 2:50 AM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\ironx86.sys [3/5/2011 2:50 AM 116784]
R2 File Backup;File Backup Service;c:\program files\Starfield\offSyncService.exe [2/2/2011 11:12 AM 1215216]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\4.3.0.5\ccsvchst.exe [3/5/2011 2:50 AM 126392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2/23/2011 12:27 PM 632792]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [4/6/2010 12:18 PM 576024]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [4/6/2010 2:04 PM 243856]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/10/2011 7:28 PM 105592]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110513.001\IDSXpx86.sys [5/13/2011 8:20 PM 341944]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [8/21/2009 8:24 PM 57248]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys –> c:\program files\LogMeIn\x86\RaInfo.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2355742841-584557978-1302645805-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-07 20:59]
.
2011-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2355742841-584557978-1302645805-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-07 20:59]
.
2011-05-16 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2011-02-23 17:28]
.
2011-05-16 c:\windows\Tasks\RMSmartUpdate.job
- c:\program files\Registry Mechanic\Update.exe [2011-02-23 17:28]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - c:\program files\Intuit\QuickBooks Enterprise Solutions 9.0\HelpAsyncPluggableProtocol.dll
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://webgames.d.tmsrv.com/c=e054adda1aa6d10f6780af8e9d15df1e/aff=t_03cm_wg/p/release/gamehouse/wg_mindmedley/mindmedley/gamehouseplayer.cab
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-iLivid - c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.exe
AddRemove-Searchqu 406 MediaBar - c:\program files\Windows iLivid Toolbar\uninstall.exe
AddRemove-{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406} - c:\documents and settings\All Users\Application Data\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}\iLividSetupV1.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-16 11:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\4.3.0.5\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2355742841-584557978-1302645805-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6f,4d,8d,54,06,dc,97,4b,b8,03,d6,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(836)
c:\windows\system32\LMIinit.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2011-05-16 11:51:56
ComboFix-quarantined-files.txt 2011-05-16 16:51
ComboFix2.txt 2011-05-16 15:16
.
Pre-Run: 429,783,351,296 bytes free
Post-Run: 429,666,263,040 bytes free
.
- - End Of File - - EDA44CB7F823A5E15F4C9F9D267F7B45
Post #9
Did you start the Chrome right after the reboot and fix?

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • Look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
  • Select Uninstall application on close check box and push [external image: Posted Image]
Post #10
Hello Conspire, The log for the ESET Online scan follows. I had to rerun the scan this morning as I deleted the log file when I answered yes to uninstall the application on close before I copied it:-( # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=efdf525d8685c140aca48d7f996a9a6d # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-05-17 12:16:16 # local_time=2011-05-17 07:16:16 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=2560 16777215 100 0 0 0 0 0 # compatibility_mode=3584 16777191 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=887384 # found=0 # cleaned=0 # scan_time=4715
Post #13
Please do this. In Google Chrome: 1. Click the wrench icon 2. Go to Options 3. Go to the Basics tab 4. Set "Default Search" to Google 5. Click close Does that work?
Post #15 last edited
Great! If you don't have outstanding issues anymore, you are good to go. :thumbup:

Follow these steps to uninstall Combofix
  • Click START then RUN
  • Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
Combofix /Uninstall
[external image: Posted Image]

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.


Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.


SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop

WOT has an add-on available for both Firefox and IE.

  • SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.
Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved and close this topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI