This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Trojan.Vundo & W32.Trats!inf

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I know this is probably getting old for most of you guys but i would really appreciate some help with this issue, i

just removed my only existing firewall (Nvidia Network Access Manager) because of crash related issues and in half a day i got

smashed with both of these viruses that started appropriating and deleting files, Norton Anti-Virus has the latest definitions but has

been rendered useless since i assume the W32 worm has deleted ccapp.exe along with everything else that is missing.


I will post a HijackThis log file according to the Instruction page when i get home, any form of assistance would be greatly appreciated,

I have tried to solve this on my own folowing directions in other such forum topics but the worm just keeps spreading.



Edit: Norton Antivirus is able to detect ddaya.dll but causes a fatal system crash shortly after. System reboots normaly, but sluggishly, other notable effects, the windows boot screen flickers and distorts for a short flash at startup, not a issue before.
hello bob4, since we last spoke i traced a few files that Norton Reported as malicious and removed them forcefully: ddaya.dll, hgghefc.dll, mrofinu27.exe

HJT Log ** IN SAFE MODE **

EDIT: should i run it in normal mode ?


Logfile of HijackThis v1.99.1
Scan saved at 9:12:57 PM, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Norton AntiVirus\navw32.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://89.188.16.10/go/?cmp=vm_mg_ff_h&…=68474&lid=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [0031c18b] rundll32.exe "C:\WINDOWS\system32\awuxccsg.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://djpunkdx.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136659656843
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/telepo…ty4LotTeleX.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5FF5410F-6BAE-473C-A8D8-2010B40C505B}: NameServer = 192.168.2.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\R2VvcmdlIEx1dHo\command.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
EDIT: In the meantime, Norton Virus Alert has detected and automatically deleted "C:\WINDOWS\system32\oipqeswc.dll" as part of Trojan.Vundo

Taken In Normal Startup

Logfile of HijackThis v1.99.1
Scan saved at 10:39:39 PM, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\R2VvcmdlIEx1dHo\command.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [0031c18b] rundll32.exe "C:\WINDOWS\system32\awuxccsg.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://djpunkdx.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136659656843
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/telepo…ty4LotTeleX.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5FF5410F-6BAE-473C-A8D8-2010B40C505B}: NameServer = 192.168.2.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\R2VvcmdlIEx1dHo\command.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
Some new developments in the meantime, a Norton AV scan of system32 revealed Trojan.Dropper under the name/location : C:\WINDOWS\system32\ap3\tycodllz83122.exe Heres the recent Norton AV Log if it helps Category: Threat alerts Date,Feature,Threat Name,Action Taken,Item Type,Target,Suspicious Action,Virus Definition Version,Product Version,User Name,Computer Name,Details 16/01/2008 10:54:02 PM,Virus scanner,Adware.Look2Me,No action taken,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,"Threat category: AdwareSource: C:\WINDOWS\system32\atmtd.dll._,Description: The file C:\WINDOWS\system32\atmtd.dll._ is a Adware threat." 16/01/2008 10:54:02 PM,Virus scanner,Adware.Look2Me,No action taken,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,"Threat category: AdwareSource: C:\WINDOWS\system32\atmtd.dll,Description: The file C:\WINDOWS\system32\atmtd.dll is a Adware threat." 16/01/2008 10:54:02 PM,Virus scanner,Trojan.Dropper,Manually deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,"Threat category: VirusSource: C:\WINDOWS\system32\ap3\tycodllz83122.exe,Description: The file C:\WINDOWS\system32\ap3\tycodllz83122.exe is infected with the Trojan.Dropper virus." 16/01/2008 10:54:02 PM,Virus scanner,W32.Trats!inf,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,"Threat category: VirusSource: c:\WINDOWS\system32\ddaya.exe,Description: The file c:\WINDOWS\system32\ddaya.exe is infected with the W32.Trats!inf virus. -The registry key: ""HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" references this threat. -The registry key: ""HKEY_USERS\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" references this threat." 16/01/2008 10:51:33 PM,Virus scanner,W32.Trats!inf,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,"Threat category: VirusSource: c:\WINDOWS\system32\ddaya.exe,Description: The file c:\WINDOWS\system32\ddaya.exe is infected with the W32.Trats!inf virus. -The registry key: ""HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" references this threat. -The registry key: ""HKEY_USERS\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" references this threat." 16/01/2008 10:43:58 PM,Auto-Protect,Trojan.Vundo,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\oipqeswc.dll 16/01/2008 10:38:21 PM,Auto-Protect,W32.Trats!inf,Repaired,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\Program Files\Common Files\Symantec Shared\ccApp.exe 16/01/2008 7:25:08 PM,Auto-Protect,W32.Trats!inf,Repaired,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\Program Files\Common Files\Symantec Shared\ccApp.exe 16/01/2008 4:33:09 AM,Auto-Protect,W32.Trats,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\ddaya.exe 16/01/2008 4:33:07 AM,Auto-Protect,W32.Trats,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\TMP15F.tmp 16/01/2008 4:31:08 AM,Auto-Protect,Trojan Horse,Access denied,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\Documents and Settings\Pwner\Local Settings\Temporary Internet Files\Content.IE5\R27D3ARV\83122[1].exe 16/01/2008 4:31:01 AM,Auto-Protect,Trojan Horse,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\Documents and Settings\Pwner\Local Settings\Temporary Internet Files\Content.IE5\R27D3ARV\83122[1].exe 16/01/2008 4:26:47 AM,Auto-Protect,W32.Trats,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\ddaya.exe 16/01/2008 4:26:40 AM,Auto-Protect,W32.Trats,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\TMP114.tmp 16/01/2008 4:23:07 AM,Auto-Protect,W32.Trats!inf,Access denied,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\winvsnet.exe 16/01/2008 4:23:07 AM,Auto-Protect,W32.Trats!inf,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\winvsnet.exe 16/01/2008 4:20:18 AM,Auto-Protect,W32.Trats!inf,Access denied,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\winvsnet.exe 16/01/2008 4:20:18 AM,Auto-Protect,W32.Trats!inf,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\winvsnet.exe 16/01/2008 4:14:06 AM,Virus scanner,W32.Trats!inf,Quarantined,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,"Threat category: VirusSource: c:\WINDOWS\system32\ddaya.exe,Description: The file c:\WINDOWS\system32\ddaya.exe is infected with the W32.Trats!inf virus. -The registry key: ""HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" referenced this threat. Norton AntiVirus removed this reference from your system. -The registry key: ""HKEY_USERS\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" references this threat. Norton AntiVirus was unable to remove the reference from your system." 16/01/2008 4:03:10 AM,Auto-Protect,W32.Trats!inf,Repaired,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\mrofinu572.exe.tmp 16/01/2008 2:29:01 AM,Auto-Protect,W32.Trats!inf,Access denied,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\ddaya.exe 16/01/2008 2:29:01 AM,Auto-Protect,W32.Trats!inf,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\ddaya.exe 15/01/2008 9:17:21 PM,Auto-Protect,W32.Trats!inf,Access denied,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\ddaya.exe 15/01/2008 9:17:21 PM,Auto-Protect,W32.Trats!inf,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\ddaya.exe 15/01/2008 9:17:21 PM,Auto-Protect,W32.Trats,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\TMPD.tmp 15/01/2008 9:17:20 PM,Auto-Protect,W32.Trats,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\TMP8.tmp 15/01/2008 9:17:19 PM,Auto-Protect,W32.Trats,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\DOCUME~1\Pwner\LOCALS~1\Temp\TMP5.tmp 15/01/2008 9:17:18 PM,Auto-Protect,W32.Trats!inf,Repaired,File,N/A,N/A,200801090006,11.0.9.16,Pwner,DX-06,Source: C:\WINDOWS\system32\ctfmon.exe 15/01/2008 9:17:11 PM,Auto-Protect,Trojan.Vundo,Automatically deleted,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 3:00:01 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 3:00:00 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:54 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:54 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:47 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:47 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:35 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:32 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:22 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:21 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:11 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:11 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:03 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:59:02 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:56 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:54 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:45 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:45 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:36 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:35 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:27 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:27 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:18 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:17 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:08 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:08 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:01 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:58:00 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:52 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:51 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:43 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:42 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:34 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:33 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:24 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:23 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:14 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:14 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:04 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:57:03 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:59 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:59 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:50 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:50 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:43 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:43 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:38 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:38 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:32 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:32 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:27 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:27 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:21 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:21 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:15 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:15 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:10 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:10 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:04 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:56:04 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:56 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:55 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:51 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:51 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:42 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:42 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:34 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:34 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:29 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:29 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:21 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:21 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:17 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:17 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:11 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:11 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:04 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:55:04 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:59 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:59 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:50 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:50 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:41 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:41 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:32 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:32 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:23 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:23 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:18 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:17 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:14 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:13 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:04 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:54:03 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:58 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:57 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:52 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:52 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:46 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:46 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:41 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:41 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:35 PM,Auto-Protect,Trojan.Vundo,Access denied,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll 15/01/2008 2:53:34 PM,Auto-Protect,Trojan.Vundo,Repair failed,File,N/A,N/A,200801090006,11.0.9.16,SYSTEM,DX-06,Source: C:\WINDOWS\system32\hgghefc.dll
OK now that I have a log I can work with we can make this go away :thumbup:

No reason to post logs I don't ask for. ;)


__________________________________
1. Download Combo fix from one of these locations.
* IMPORTANT !!! Place combofix.exe on your Desktop

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

2. Click start/run and copy and Paste this in exactly using the picture below for reference:

"%userprofile%\desktop\combofix.exe" /killall


[external image: Posted Image]

3. Combo will begin to run DO NOTING while this is happeneing.
  • It will kill a few processes and disconnect you from the internet.
  • If by chance it stops prematurly you can re-establish your internet connection by restarting your computer.
  • This needs to be done so the program can work most efficiently for you.
Do not attempt to use the internet or anything else while it's doing its job for you.

If when it's completed you can not get on the internet just reboot the computer

Post the log from comboFix for me located in
c:\comboFix.txt

____________________________


In your next reply I would like to see:
  • A new HJT log
  • The report from ComboFix
Do nothing else untill I post back to you. It's late here now I will check on this in about 6 hrs from now.
Its late here too, well 5 in the morning now, thank you for your help so far. As a note, a combofix script was paused by Norton after it restarted my computer, i shut down norton and Combofix finished its tasks, should i re run the process ?

ComboFix 08-01-18.4 - Pwner 2008-01-17 0:23:58.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1649 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\My Documents\pos201.tmp
C:\Documents and Settings\Administrator\My Documents\pos202.tmp
C:\Documents and Settings\Administrator\My Documents\pos203.tmp
C:\Documents and Settings\Administrator\My Documents\pos204.tmp
C:\Documents and Settings\Administrator\My Documents\pos205.tmp
C:\Documents and Settings\Administrator\My Documents\pos206.tmp
C:\Documents and Settings\Administrator\My Documents\pos207.tmp
C:\Documents and Settings\Administrator\My Documents\pos208.tmp
C:\Documents and Settings\Administrator\My Documents\pos209.tmp
C:\Documents and Settings\Administrator\My Documents\pos20A.tmp
C:\Documents and Settings\Administrator\My Documents\pos20B.tmp
C:\Documents and Settings\Administrator\My Documents\pos20C.tmp
C:\Documents and Settings\Administrator\My Documents\pos20D.tmp
C:\Documents and Settings\Administrator\My Documents\pos20E.tmp
C:\Documents and Settings\Administrator\My Documents\pos20F.tmp
C:\Documents and Settings\Administrator\My Documents\pos210.tmp
C:\Documents and Settings\Administrator\My Documents\pos211.tmp
C:\Documents and Settings\Administrator\My Documents\pos212.tmp
C:\Documents and Settings\Administrator\My Documents\pos213.tmp
C:\Documents and Settings\Administrator\My Documents\pos214.tmp
C:\Documents and Settings\Administrator\My Documents\pos215.tmp
C:\Documents and Settings\Administrator\My Documents\pos216.tmp
C:\Documents and Settings\Administrator\My Documents\pos217.tmp
C:\Documents and Settings\Administrator\My Documents\pos218.tmp
C:\Documents and Settings\Administrator\My Documents\pos219.tmp
C:\Documents and Settings\Administrator\My Documents\pos21A.tmp
C:\Documents and Settings\Administrator\My Documents\pos21B.tmp
C:\Documents and Settings\Administrator\My Documents\pos21C.tmp
C:\Documents and Settings\Administrator\My Documents\pos21D.tmp
C:\Documents and Settings\Administrator\My Documents\pos21E.tmp
C:\Documents and Settings\Administrator\My Documents\pos21F.tmp
C:\Documents and Settings\Administrator\My Documents\pos220.tmp
C:\Documents and Settings\Administrator\My Documents\pos221.tmp
C:\Documents and Settings\Administrator\My Documents\pos222.tmp
C:\Documents and Settings\Administrator\My Documents\pos223.tmp
C:\Documents and Settings\Administrator\My Documents\pos224.tmp
C:\Documents and Settings\Administrator\My Documents\pos225.tmp
C:\Documents and Settings\Administrator\My Documents\pos226.tmp
C:\Documents and Settings\Administrator\My Documents\pos227.tmp
C:\Documents and Settings\Administrator\My Documents\pos228.tmp
C:\Documents and Settings\Administrator\My Documents\pos229.tmp
C:\Documents and Settings\Administrator\My Documents\pos22A.tmp
C:\Documents and Settings\Administrator\My Documents\pos22B.tmp
C:\Documents and Settings\Administrator\My Documents\pos22C.tmp
C:\Documents and Settings\Administrator\My Documents\pos22D.tmp
C:\Documents and Settings\Administrator\My Documents\pos22E.tmp
C:\Documents and Settings\Administrator\My Documents\pos22F.tmp
C:\Documents and Settings\Administrator\My Documents\pos230.tmp
C:\Documents and Settings\Administrator\My Documents\pos231.tmp
C:\Documents and Settings\Administrator\My Documents\pos232.tmp
C:\Documents and Settings\Administrator\My Documents\pos233.tmp
C:\Documents and Settings\Administrator\My Documents\pos234.tmp
C:\Documents and Settings\Administrator\My Documents\pos235.tmp
C:\Documents and Settings\Administrator\My Documents\pos236.tmp
C:\Documents and Settings\Administrator\My Documents\pos237.tmp
C:\Documents and Settings\Administrator\My Documents\pos238.tmp
C:\Documents and Settings\Administrator\My Documents\pos239.tmp
C:\Documents and Settings\Administrator\My Documents\pos23A.tmp
C:\Documents and Settings\Administrator\My Documents\pos23B.tmp
C:\Documents and Settings\Administrator\My Documents\pos23C.tmp
C:\Documents and Settings\Administrator\My Documents\pos23D.tmp
C:\Documents and Settings\Administrator\My Documents\pos23E.tmp
C:\Documents and Settings\Administrator\My Documents\pos23F.tmp
C:\Documents and Settings\Administrator\My Documents\pos240.tmp
C:\Documents and Settings\Administrator\My Documents\pos241.tmp
C:\Documents and Settings\Administrator\My Documents\pos242.tmp
C:\Documents and Settings\Administrator\My Documents\pos243.tmp
C:\Documents and Settings\Administrator\My Documents\pos244.tmp
C:\Documents and Settings\Administrator\My Documents\pos245.tmp
C:\Documents and Settings\Administrator\My Documents\pos246.tmp
C:\Documents and Settings\Administrator\My Documents\pos247.tmp
C:\Documents and Settings\Administrator\My Documents\pos248.tmp
C:\Documents and Settings\Administrator\My Documents\pos249.tmp
C:\Documents and Settings\Administrator\My Documents\pos24A.tmp
C:\Documents and Settings\Administrator\My Documents\pos24B.tmp
C:\Documents and Settings\Administrator\My Documents\pos24C.tmp
C:\Documents and Settings\Administrator\My Documents\pos24D.tmp
C:\Documents and Settings\Administrator\My Documents\pos24E.tmp
C:\Documents and Settings\Administrator\My Documents\pos24F.tmp
C:\Documents and Settings\Administrator\My Documents\pos250.tmp
C:\Documents and Settings\Administrator\My Documents\pos251.tmp
C:\Documents and Settings\Administrator\My Documents\pos252.tmp
C:\Documents and Settings\Administrator\My Documents\pos253.tmp
C:\Documents and Settings\Administrator\My Documents\pos254.tmp
C:\Documents and Settings\Administrator\My Documents\pos255.tmp
C:\Documents and Settings\Administrator\My Documents\pos256.tmp
C:\Documents and Settings\Administrator\My Documents\pos257.tmp
C:\Documents and Settings\Administrator\My Documents\pos258.tmp
C:\Documents and Settings\Administrator\My Documents\pos259.tmp
C:\Documents and Settings\Administrator\My Documents\pos25A.tmp
C:\Documents and Settings\Administrator\My Documents\pos25B.tmp
C:\Documents and Settings\Administrator\My Documents\pos25C.tmp
C:\Documents and Settings\Administrator\My Documents\pos25D.tmp
C:\Documents and Settings\Administrator\My Documents\pos25E.tmp
C:\Documents and Settings\Administrator\My Documents\pos25F.tmp
C:\Documents and Settings\Administrator\My Documents\pos260.tmp
C:\Documents and Settings\Administrator\My Documents\pos261.tmp
C:\Documents and Settings\Administrator\My Documents\pos262.tmp
C:\Documents and Settings\Administrator\My Documents\pos263.tmp
C:\Documents and Settings\Administrator\My Documents\pos264.tmp
C:\Documents and Settings\Administrator\My Documents\pos265.tmp
C:\Documents and Settings\Administrator\My Documents\pos266.tmp
C:\Documents and Settings\Administrator\My Documents\pos267.tmp
C:\Documents and Settings\Administrator\My Documents\pos268.tmp
C:\Documents and Settings\Administrator\My Documents\pos269.tmp
C:\Documents and Settings\Administrator\My Documents\pos26A.tmp
C:\Documents and Settings\Administrator\My Documents\pos26B.tmp
C:\Documents and Settings\Administrator\My Documents\pos26C.tmp
C:\Documents and Settings\Administrator\My Documents\pos26D.tmp
C:\Documents and Settings\Administrator\My Documents\pos26E.tmp
C:\Documents and Settings\Administrator\My Documents\pos26F.tmp
C:\Documents and Settings\Administrator\My Documents\pos270.tmp
C:\Documents and Settings\Administrator\My Documents\pos271.tmp
C:\Documents and Settings\Administrator\My Documents\pos272.tmp
C:\Documents and Settings\Administrator\My Documents\pos273.tmp
C:\Documents and Settings\Administrator\My Documents\pos274.tmp
C:\Documents and Settings\Administrator\My Documents\pos275.tmp
C:\Documents and Settings\Administrator\My Documents\pos276.tmp
C:\Documents and Settings\Administrator\My Documents\pos277.tmp
C:\Documents and Settings\Administrator\My Documents\pos278.tmp
C:\Documents and Settings\Administrator\My Documents\pos279.tmp
C:\Documents and Settings\Administrator\My Documents\pos27A.tmp
C:\Documents and Settings\Administrator\My Documents\pos27B.tmp
C:\Documents and Settings\Administrator\My Documents\pos27C.tmp
C:\Documents and Settings\Administrator\My Documents\pos27D.tmp
C:\Documents and Settings\Administrator\My Documents\pos27E.tmp
C:\Documents and Settings\Administrator\My Documents\pos27F.tmp
C:\Documents and Settings\Administrator\My Documents\pos280.tmp
C:\Documents and Settings\Administrator\My Documents\pos281.tmp
C:\Documents and Settings\Administrator\My Documents\pos282.tmp
C:\Documents and Settings\Administrator\My Documents\pos283.tmp
C:\Documents and Settings\Administrator\My Documents\pos284.tmp
C:\Documents and Settings\Administrator\My Documents\pos285.tmp
C:\Documents and Settings\Administrator\My Documents\pos286.tmp
C:\Documents and Settings\Administrator\My Documents\pos287.tmp
C:\Documents and Settings\Administrator\My Documents\pos288.tmp
C:\Documents and Settings\Administrator\My Documents\pos289.tmp
C:\Documents and Settings\Administrator\My Documents\pos28A.tmp
C:\Documents and Settings\Administrator\My Documents\pos28B.tmp
C:\Documents and Settings\Administrator\My Documents\pos28C.tmp
C:\Documents and Settings\Administrator\My Documents\pos28D.tmp
C:\Documents and Settings\Administrator\My Documents\pos28E.tmp
C:\Documents and Settings\Administrator\My Documents\pos28F.tmp
C:\Documents and Settings\Administrator\My Documents\pos290.tmp
C:\Documents and Settings\Administrator\My Documents\pos291.tmp
C:\Documents and Settings\Administrator\My Documents\pos292.tmp
C:\Documents and Settings\Administrator\My Documents\pos293.tmp
C:\Documents and Settings\Administrator\My Documents\pos294.tmp
C:\Documents and Settings\Administrator\My Documents\pos295.tmp
C:\Documents and Settings\Administrator\My Documents\pos296.tmp
C:\Documents and Settings\Administrator\My Documents\pos297.tmp
C:\Documents and Settings\Administrator\My Documents\pos298.tmp
C:\Documents and Settings\Administrator\My Documents\pos299.tmp
C:\Documents and Settings\Administrator\My Documents\pos29A.tmp
C:\Documents and Settings\Administrator\My Documents\pos29B.tmp
C:\Documents and Settings\Administrator\My Documents\pos29C.tmp
C:\Documents and Settings\Administrator\My Documents\pos29D.tmp
C:\Documents and Settings\Administrator\My Documents\pos29E.tmp
C:\Documents and Settings\Administrator\My Documents\pos29F.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A0.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A1.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A2.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A3.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A4.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A5.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A6.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A7.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A8.tmp
C:\Documents and Settings\Administrator\My Documents\pos2A9.tmp
C:\Documents and Settings\Administrator\My Documents\pos2AA.tmp
C:\Documents and Settings\Administrator\My Documents\pos2AB.tmp
C:\Documents and Settings\Administrator\My Documents\pos2AC.tmp
C:\Documents and Settings\Administrator\My Documents\pos2AD.tmp
C:\Documents and Settings\Administrator\My Documents\pos2AE.tmp
C:\Documents and Settings\Administrator\My Documents\pos2AF.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B0.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B1.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B2.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B3.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B4.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B5.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B6.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B7.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B8.tmp
C:\Documents and Settings\Administrator\My Documents\pos2B9.tmp
C:\Documents and Settings\Administrator\My Documents\pos2BA.tmp
C:\Documents and Settings\Administrator\My Documents\pos2BB.tmp
C:\Documents and Settings\Administrator\My Documents\pos2BC.tmp
C:\Documents and Settings\Administrator\My Documents\pos2BD.tmp
C:\Documents and Settings\Administrator\My Documents\pos2BE.tmp
C:\Documents and Settings\Administrator\My Documents\pos2BF.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C0.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C1.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C2.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C3.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C4.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C5.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C6.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C7.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C8.tmp
C:\Documents and Settings\Administrator\My Documents\pos2C9.tmp
C:\Documents and Settings\Administrator\My Documents\pos2CA.tmp
C:\Documents and Settings\Administrator\My Documents\pos2CB.tmp
C:\Documents and Settings\Administrator\My Documents\pos2CC.tmp
C:\Documents and Settings\Administrator\My Documents\pos2CD.tmp
C:\Documents and Settings\Administrator\My Documents\pos2CE.tmp
C:\Documents and Settings\Administrator\My Documents\pos2CF.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D0.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D1.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D2.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D3.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D4.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D5.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D6.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D7.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D8.tmp
C:\Documents and Settings\Administrator\My Documents\pos2D9.tmp
C:\Documents and Settings\Administrator\My Documents\pos2DA.tmp
C:\Documents and Settings\Administrator\My Documents\pos2DB.tmp
C:\Documents and Settings\Administrator\My Documents\pos2DC.tmp
C:\Documents and Settings\Administrator\My Documents\pos2DD.tmp
C:\Documents and Settings\Administrator\My Documents\pos2DE.tmp
C:\Documents and Settings\Administrator\My Documents\pos2DF.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E0.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E1.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E2.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E3.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E4.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E5.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E6.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E7.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E8.tmp
C:\Documents and Settings\Administrator\My Documents\pos2E9.tmp
C:\Documents and Settings\Administrator\My Documents\pos2EA.tmp
C:\Documents and Settings\Administrator\My Documents\pos2EB.tmp
C:\Documents and Settings\Administrator\My Documents\pos2EC.tmp
C:\Documents and Settings\Administrator\My Documents\pos2ED.tmp
C:\Documents and Settings\Administrator\My Documents\pos2EE.tmp
C:\Documents and Settings\Administrator\My Documents\pos2EF.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F0.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F1.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F2.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F3.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F4.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F5.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F6.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F7.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F8.tmp
C:\Documents and Settings\Administrator\My Documents\pos2F9.tmp
C:\Documents and Settings\Administrator\My Documents\pos2FA.tmp
C:\Documents and Settings\Administrator\My Documents\pos2FB.tmp
C:\Documents and Settings\Administrator\My Documents\pos2FC.tmp
C:\Documents and Settings\Administrator\My Documents\pos2FD.tmp
C:\Documents and Settings\Administrator\My Documents\pos2FE.tmp
C:\Documents and Settings\Administrator\My Documents\pos2FF.tmp
C:\Documents and Settings\Administrator\My Documents\pos300.tmp
C:\Documents and Settings\Administrator\My Documents\pos301.tmp
C:\Documents and Settings\Administrator\My Documents\pos302.tmp
C:\Documents and Settings\Administrator\My Documents\pos303.tmp
C:\Documents and Settings\Administrator\My Documents\pos304.tmp
C:\Documents and Settings\Administrator\My Documents\pos305.tmp
C:\Documents and Settings\Administrator\My Documents\pos306.tmp
C:\Documents and Settings\Administrator\My Documents\pos307.tmp
C:\Documents and Settings\Administrator\My Documents\pos308.tmp
C:\Documents and Settings\Administrator\My Documents\pos309.tmp
C:\Documents and Settings\Administrator\My Documents\pos30A.tmp
C:\Documents and Settings\Administrator\My Documents\pos30B.tmp
C:\Documents and Settings\Administrator\My Documents\pos30C.tmp
C:\Documents and Settings\Administrator\My Documents\pos30D.tmp
C:\Documents and Settings\Administrator\My Documents\pos30E.tmp
C:\Documents and Settings\Administrator\My Documents\pos30F.tmp
C:\Documents and Settings\Administrator\My Documents\pos310.tmp
C:\Documents and Settings\Administrator\My Documents\pos311.tmp
C:\Documents and Settings\Administrator\My Documents\pos312.tmp
C:\Documents and Settings\Administrator\My Documents\pos314.tmp
C:\Documents and Settings\Administrator\My Documents\pos315.tmp
C:\Documents and Settings\Administrator\My Documents\pos316.tmp
C:\Documents and Settings\Administrator\My Documents\pos317.tmp
C:\Documents and Settings\Administrator\My Documents\pos318.tmp
C:\Documents and Settings\Administrator\My Documents\pos319.tmp
C:\Documents and Settings\Administrator\My Documents\pos31A.tmp
C:\Documents and Settings\Administrator\My Documents\pos31B.tmp
C:\Documents and Settings\Administrator\My Documents\pos31C.tmp
C:\Documents and Settings\Administrator\My Documents\pos31D.tmp
C:\Documents and Settings\Administrator\My Documents\pos31E.tmp
C:\Documents and Settings\Administrator\My Documents\pos31F.tmp
C:\Documents and Settings\Administrator\My Documents\pos320.tmp
C:\Documents and Settings\Administrator\My Documents\pos321.tmp
C:\Documents and Settings\Administrator\My Documents\pos322.tmp
C:\Documents and Settings\Administrator\My Documents\pos323.tmp
C:\Documents and Settings\Administrator\My Documents\pos324.tmp
C:\Documents and Settings\Administrator\My Documents\pos325.tmp
C:\Documents and Settings\Administrator\My Documents\pos326.tmp
C:\Documents and Settings\Administrator\My Documents\pos327.tmp
C:\Documents and Settings\Administrator\My Documents\pos328.tmp
C:\Documents and Settings\Administrator\My Documents\pos329.tmp
C:\Documents and Settings\Administrator\My Documents\pos32A.tmp
C:\Documents and Settings\Administrator\My Documents\pos32B.tmp
C:\Documents and Settings\Administrator\My Documents\pos32C.tmp
C:\Documents and Settings\Administrator\My Documents\pos32D.tmp
C:\Documents and Settings\Administrator\My Documents\pos32E.tmp
C:\Documents and Settings\Administrator\My Documents\pos32F.tmp
C:\Documents and Settings\Administrator\My Documents\pos330.tmp
C:\Documents and Settings\Administrator\My Documents\pos331.tmp
C:\Documents and Settings\Administrator\My Documents\pos332.tmp
C:\Documents and Settings\Administrator\My Documents\pos333.tmp
C:\Documents and Settings\Administrator\My Documents\pos334.tmp
C:\Documents and Settings\Administrator\My Documents\pos335.tmp
C:\Documents and Settings\Administrator\My Documents\pos336.tmp
C:\Documents and Settings\Administrator\My Documents\pos337.tmp
C:\Documents and Settings\Administrator\My Documents\pos338.tmp
C:\Documents and Settings\Administrator\My Documents\pos339.tmp
C:\Documents and Settings\Administrator\My Documents\pos33A.tmp
C:\Documents and Settings\Administrator\My Documents\pos33B.tmp
C:\Documents and Settings\Administrator\My Documents\pos33C.tmp
C:\Documents and Settings\Administrator\My Documents\pos33D.tmp
C:\Documents and Settings\Administrator\My Documents\pos33E.tmp
C:\Documents and Settings\Administrator\My Documents\pos33F.tmp
C:\Documents and Settings\Administrator\My Documents\pos340.tmp
C:\Documents and Settings\Administrator\My Documents\pos341.tmp
C:\Documents and Settings\Administrator\My Documents\pos342.tmp
C:\Documents and Settings\Administrator\My Documents\pos343.tmp
C:\Documents and Settings\Administrator\My Documents\pos344.tmp
C:\Documents and Settings\Administrator\My Documents\pos345.tmp
C:\Documents and Settings\Administrator\My Documents\pos346.tmp
C:\Documents and Settings\Administrator\My Documents\pos347.tmp
C:\Documents and Settings\Administrator\My Documents\pos348.tmp
C:\Documents and Settings\Administrator\My Documents\pos349.tmp
C:\Documents and Settings\Administrator\My Documents\pos34A.tmp
C:\Documents and Settings\Administrator\My Documents\pos34B.tmp
C:\Documents and Settings\Administrator\My Documents\pos34C.tmp
C:\Documents and Settings\Administrator\My Documents\pos34D.tmp
C:\Documents and Settings\Administrator\My Documents\pos34E.tmp
C:\Documents and Settings\Administrator\My Documents\pos34F.tmp
C:\Documents and Settings\Administrator\My Documents\pos350.tmp
C:\Documents and Settings\Administrator\My Documents\pos351.tmp
C:\Documents and Settings\Administrator\My Documents\pos352.tmp
C:\Documents and Settings\Administrator\My Documents\pos353.tmp
C:\Documents and Settings\Administrator\My Documents\pos354.tmp
C:\Documents and Settings\Administrator\My Documents\pos355.tmp
C:\Documents and Settings\Administrator\My Documents\pos356.tmp
C:\Documents and Settings\Administrator\My Documents\pos357.tmp
C:\Documents and Settings\Administrator\My Documents\pos358.tmp
C:\Documents and Settings\Administrator\My Documents\pos359.tmp
C:\Documents and Settings\Administrator\My Documents\pos35A.tmp
C:\Documents and Settings\Administrator\My Documents\pos35B.tmp
C:\Documents and Settings\Administrator\My Documents\pos35C.tmp
C:\Documents and Settings\Administrator\My Documents\pos35D.tmp
C:\Documents and Settings\Administrator\My Documents\pos35E.tmp
C:\Documents and Settings\Administrator\My Documents\pos35F.tmp
C:\Documents and Settings\Administrator\My Documents\pos360.tmp
C:\Documents and Settings\Administrator\My Documents\pos361.tmp
C:\Documents and Settings\Administrator\My Documents\pos362.tmp
C:\Documents and Settings\Administrator\My Documents\pos363.tmp
C:\Documents and Settings\Administrator\My Documents\pos364.tmp
C:\Documents and Settings\Administrator\My Documents\pos365.tmp
C:\Documents and Settings\Administrator\My Documents\pos366.tmp
C:\Documents and Settings\Administrator\My Documents\pos367.tmp
C:\Documents and Settings\Administrator\My Documents\pos368.tmp
C:\Documents and Settings\Administrator\My Documents\pos369.tmp
C:\Documents and Settings\Administrator\My Documents\pos36A.tmp
C:\Documents and Settings\Administrator\My Documents\pos36B.tmp
C:\Documents and Settings\Administrator\My Documents\pos36C.tmp
C:\Documents and Settings\Administrator\My Documents\pos36D.tmp
C:\Documents and Settings\Administrator\My Documents\pos36E.tmp
C:\Documents and Settings\Administrator\My Documents\pos36F.tmp
C:\Documents and Settings\Administrator\My Documents\pos370.tmp
C:\Documents and Settings\Administrator\My Documents\pos371.tmp
C:\Documents and Settings\Administrator\My Documents\pos372.tmp
C:\Documents and Settings\Administrator\My Documents\pos373.tmp
C:\Documents and Settings\Administrator\My Documents\pos374.tmp
C:\Documents and Settings\Administrator\My Documents\pos375.tmp
C:\Documents and Settings\Administrator\My Documents\pos376.tmp
C:\Documents and Settings\Administrator\My Documents\pos377.tmp
C:\Documents and Settings\Administrator\My Documents\pos378.tmp
C:\Documents and Settings\Administrator\My Documents\pos379.tmp
C:\Documents and Settings\Administrator\My Documents\pos37A.tmp
C:\Documents and Settings\Administrator\My Documents\pos37B.tmp
C:\Documents and Settings\Administrator\My Documents\pos37C.tmp
C:\Documents and Settings\Administrator\My Documents\pos37D.tmp
C:\Documents and Settings\Administrator\My Documents\pos37E.tmp
C:\Documents and Settings\Administrator\My Documents\pos37F.tmp
C:\Documents and Settings\Administrator\My Documents\pos380.tmp
C:\Documents and Settings\Administrator\My Documents\pos381.tmp
C:\Documents and Settings\Administrator\My Documents\pos382.tmp
C:\Documents and Settings\Administrator\My Documents\pos383.tmp
C:\Documents and Settings\Administrator\My Documents\pos384.tmp
C:\Documents and Settings\Administrator\My Documents\pos385.tmp
C:\Documents and Settings\Administrator\My Documents\pos386.tmp
C:\Documents and Settings\Administrator\My Documents\pos387.tmp
C:\Documents and Settings\Administrator\My Documents\pos388.tmp
C:\Documents and Settings\Administrator\My Documents\pos389.tmp
C:\Documents and Settings\Administrator\My Documents\pos38A.tmp
C:\Documents and Settings\Administrator\My Documents\pos38B.tmp
C:\Documents and Settings\Administrator\My Documents\pos38C.tmp
C:\Documents and Settings\Administrator\My Documents\pos38D.tmp
C:\Documents and Settings\Administrator\My Documents\pos38E.tmp
C:\Documents and Settings\Administrator\My Documents\pos38F.tmp
C:\Documents and Settings\Administrator\My Documents\pos390.tmp
C:\Documents and Settings\Administrator\My Documents\pos391.tmp
C:\Documents and Settings\Administrator\My Documents\pos392.tmp
C:\Documents and Settings\Administrator\My Documents\pos393.tmp
C:\Documents and Settings\Administrator\My Documents\pos394.tmp
C:\Documents and Settings\Administrator\My Documents\pos395.tmp
C:\Documents and Settings\Administrator\My Documents\pos396.tmp
C:\Documents and Settings\Administrator\My Documents\pos397.tmp
C:\Documents and Settings\Administrator\My Documents\pos398.tmp
C:\Documents and Settings\Administrator\My Documents\pos399.tmp
C:\Documents and Settings\Administrator\My Documents\pos39A.tmp
C:\Documents and Settings\Administrator\My Documents\pos39B.tmp
C:\Documents and Settings\Administrator\My Documents\pos39C.tmp
C:\Documents and Settings\Administrator\My Documents\pos39D.tmp
C:\Documents and Settings\Administrator\My Documents\pos39E.tmp
C:\Documents and Settings\Administrator\My Documents\pos39F.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A0.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A1.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A2.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A3.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A4.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A5.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A6.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A7.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A8.tmp
C:\Documents and Settings\Administrator\My Documents\pos3A9.tmp
C:\Documents and Settings\Administrator\My Documents\pos3AA.tmp
C:\Documents and Settings\Administrator\My Documents\pos3AB.tmp
C:\Documents and Settings\Administrator\My Documents\pos3AC.tmp
C:\Documents and Settings\Administrator\My Documents\pos3AD.tmp
C:\Documents and Settings\Administrator\My Documents\pos3AE.tmp
C:\Documents and Settings\Administrator\My Documents\pos3AF.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B0.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B1.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B2.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B3.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B4.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B5.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B6.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B7.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B8.tmp
C:\Documents and Settings\Administrator\My Documents\pos3B9.tmp
C:\Documents and Settings\Administrator\My Documents\pos3BA.tmp
C:\Documents and Settings\Administrator\My Documents\pos3BB.tmp
C:\Documents and Settings\Administrator\My Documents\pos3BC.tmp
C:\Documents and Settings\Administrator\My Documents\pos3BD.tmp
C:\Documents and Settings\Administrator\My Documents\pos3BE.tmp
C:\Documents and Settings\Administrator\My Documents\pos3BF.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C0.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C1.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C2.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C3.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C4.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C5.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C6.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C7.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C8.tmp
C:\Documents and Settings\Administrator\My Documents\pos3C9.tmp
C:\Documents and Settings\Administrator\My Documents\pos3CA.tmp
C:\Documents and Settings\Administrator\My Documents\pos3CB.tmp
C:\Documents and Settings\Administrator\My Documents\pos3CC.tmp
C:\Documents and Settings\Administrator\My Documents\pos3CD.tmp
C:\Documents and Settings\Administrator\My Documents\pos3CE.tmp
C:\Documents and Settings\Administrator\My Documents\pos3CF.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D0.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D1.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D2.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D3.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D4.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D5.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D6.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D7.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D8.tmp
C:\Documents and Settings\Administrator\My Documents\pos3D9.tmp
C:\Documents and Settings\Administrator\My Documents\pos3DA.tmp
C:\Documents and Settings\Administrator\My Documents\pos3DB.tmp
C:\Documents and Settings\Administrator\My Documents\pos3DC.tmp
C:\Documents and Settings\Administrator\My Documents\pos3DD.tmp
C:\Documents and Settings\Administrator\My Documents\pos3DE.tmp
C:\Documents and Settings\Administrator\My Documents\pos3DF.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E0.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E1.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E2.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E3.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E4.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E5.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E6.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E7.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E8.tmp
C:\Documents and Settings\Administrator\My Documents\pos3E9.tmp
C:\Documents and Settings\Administrator\My Documents\pos3EA.tmp
C:\Documents and Settings\Administrator\My Documents\pos3EB.tmp
C:\Documents and Settings\Administrator\My Documents\pos3EC.tmp
C:\Documents and Settings\Administrator\My Documents\pos3ED.tmp
C:\Documents and Settings\Administrator\My Documents\pos3EE.tmp
C:\Documents and Settings\Administrator\My Documents\pos3EF.tmp
C:\Documents and Settings\Administrator\My Documents\pos3F0.tmp
C:\Documents and Settings\Administrator\My Documents\pos3F1.tmp
C:\Documents and Settings\Administrator\My Documents\pos3F2.tmp
C:\Documents and Settings\Administrator\My Documents\pos3F3.tmp
C:\Documents and Settings\Administrator\My Documents\pos3F4.tmp
C:\Documents and Settings\Administrator\My Documents\pos3F5.tmp
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\Pwner\Application Data\SMANTE~1
C:\Documents and Settings\Pwner\My Documents\pos3ED.tmp
C:\Documents and Settings\Pwner\My Documents\pos3EE.tmp
C:\Documents and Settings\Pwner\My Documents\pos3EF.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F0.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F1.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F2.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F3.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F4.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F5.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F6.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F7.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F8.tmp
C:\Documents and Settings\Pwner\My Documents\pos3F9.tmp
C:\Documents and Settings\Pwner\My Documents\pos3FA.tmp
C:\Documents and Settings\Pwner\My Documents\pos3FB.tmp
C:\Documents and Settings\Pwner\My Documents\pos3FC.tmp
C:\Documents and Settings\Pwner\My Documents\pos3FD.tmp
C:\Documents and Settings\Pwner\My Documents\pos3FE.tmp
C:\Documents and Settings\Pwner\My Documents\pos3FF.tmp
C:\Documents and Settings\Pwner\My Documents\pos400.tmp
C:\Documents and Settings\Pwner\My Documents\pos401.tmp
C:\Documents and Settings\Pwner\My Documents\pos402.tmp
C:\Documents and Settings\Pwner\My Documents\pos403.tmp
C:\Documents and Settings\Pwner\My Documents\pos404.tmp
C:\Documents and Settings\Pwner\My Documents\pos405.tmp
C:\Documents and Settings\Pwner\My Documents\pos406.tmp
C:\Documents and Settings\Pwner\My Documents\pos407.tmp
C:\Documents and Settings\Pwner\My Documents\pos408.tmp
C:\Documents and Settings\Pwner\My Documents\pos409.tmp
C:\Documents and Settings\Pwner\My Documents\pos40A.tmp
C:\Documents and Settings\Pwner\My Documents\pos40B.tmp
C:\Documents and Settings\Pwner\My Documents\pos40C.tmp
C:\Documents and Settings\Pwner\My Documents\pos40D.tmp
C:\Documents and Settings\Pwner\My Documents\pos40E.tmp
C:\Documents and Settings\Pwner\My Documents\pos40F.tmp
C:\Documents and Settings\Pwner\My Documents\pos410.tmp
C:\Documents and Settings\Pwner\My Documents\pos411.tmp
C:\Documents and Settings\Pwner\My Documents\pos412.tmp
C:\Documents and Settings\Pwner\My Documents\pos413.tmp
C:\Documents and Settings\Pwner\My Documents\pos414.tmp
C:\Documents and Settings\Pwner\My Documents\pos415.tmp
C:\Documents and Settings\Pwner\My Documents\pos416.tmp
C:\Documents and Settings\Pwner\My Documents\pos417.tmp
C:\Documents and Settings\Pwner\My Documents\pos418.tmp
C:\Documents and Settings\Pwner\My Documents\pos419.tmp
C:\Documents and Settings\Pwner\My Documents\pos41A.tmp
C:\Documents and Settings\Pwner\My Documents\pos41B.tmp
C:\Documents and Settings\Pwner\My Documents\pos41C.tmp
C:\Documents and Settings\Pwner\My Documents\pos41D.tmp
C:\Documents and Settings\Pwner\My Documents\pos41E.tmp
C:\Documents and Settings\Pwner\My Documents\pos41F.tmp
C:\Documents and Settings\Pwner\My Documents\pos420.tmp
C:\Documents and Settings\Pwner\My Documents\pos421.tmp
C:\Documents and Settings\Pwner\My Documents\pos422.tmp
C:\Documents and Settings\Pwner\My Documents\pos423.tmp
C:\Documents and Settings\Pwner\My Documents\pos424.tmp
C:\Documents and Settings\Pwner\My Documents\pos425.tmp
C:\Documents and Settings\Pwner\My Documents\pos426.tmp
C:\Documents and Settings\Pwner\My Documents\pos427.tmp
C:\Documents and Settings\Pwner\My Documents\pos428.tmp
C:\Documents and Settings\Pwner\My Documents\pos429.tmp
C:\Documents and Settings\Pwner\My Documents\pos42A.tmp
C:\Documents and Settings\Pwner\My Documents\pos42B.tmp
C:\Documents and Settings\Pwner\My Documents\pos42C.tmp
C:\Documents and Settings\Pwner\My Documents\pos42D.tmp
C:\Documents and Settings\Pwner\My Documents\pos42E.tmp
C:\Documents and Settings\Pwner\My Documents\pos42F.tmp
C:\Documents and Settings\Pwner\My Documents\pos430.tmp
C:\Documents and Settings\Pwner\My Documents\pos431.tmp
C:\Documents and Settings\Pwner\My Documents\pos432.tmp
C:\Documents and Settings\Pwner\My Documents\pos433.tmp
C:\Documents and Settings\Pwner\My Documents\pos434.tmp
C:\Documents and Settings\Pwner\My Documents\pos435.tmp
C:\Documents and Settings\Pwner\My Documents\pos436.tmp
C:\Documents and Settings\Pwner\My Documents\pos437.tmp
C:\Documents and Settings\Pwner\My Documents\pos438.tmp
C:\Documents and Settings\Pwner\My Documents\pos439.tmp
C:\Documents and Settings\Pwner\My Documents\pos43A.tmp
C:\Documents and Settings\Pwner\My Documents\pos43B.tmp
C:\Documents and Settings\Pwner\My Documents\pos43C.tmp
C:\Documents and Settings\Pwner\My Documents\pos43D.tmp
C:\Documents and Settings\Pwner\My Documents\pos43E.tmp
C:\Documents and Settings\Pwner\My Documents\pos43F.tmp
C:\Documents and Settings\Pwner\My Documents\pos440.tmp
C:\Documents and Settings\Pwner\My Documents\pos441.tmp
C:\Documents and Settings\Pwner\My Documents\pos442.tmp
C:\Documents and Settings\Pwner\My Documents\pos443.tmp
C:\Documents and Settings\Pwner\My Documents\pos444.tmp
C:\Documents and Settings\Pwner\My Documents\pos445.tmp
C:\Documents and Settings\Pwner\My Documents\pos446.tmp
C:\Documents and Settings\Pwner\My Documents\pos447.tmp
C:\Documents and Settings\Pwner\My Documents\pos448.tmp
C:\Documents and Settings\Pwner\My Documents\pos449.tmp
C:\Documents and Settings\Pwner\My Documents\pos44A.tmp
C:\Documents and Settings\Pwner\My Documents\pos44B.tmp
C:\Documents and Settings\Pwner\My Documents\pos44C.tmp
C:\Documents and Settings\Pwner\My Documents\pos44D.tmp
C:\Documents and Settings\Pwner\My Documents\pos44E.tmp
C:\Documents and Settings\Pwner\My Documents\pos44F.tmp
C:\Documents and Settings\Pwner\My Documents\pos450.tmp
C:\Documents and Settings\Pwner\My Documents\pos451.tmp
C:\Documents and Settings\Pwner\My Documents\pos452.tmp
C:\Documents and Settings\Pwner\My Documents\pos453.tmp
C:\Documents and Settings\Pwner\My Documents\pos454.tmp
C:\Documents and Settings\Pwner\My Documents\pos455.tmp
C:\Documents and Settings\Pwner\My Documents\pos456.tmp
C:\Documents and Settings\Pwner\My Documents\pos457.tmp
C:\Documents and Settings\Pwner\My Documents\pos458.tmp
C:\Documents and Settings\Pwner\My Documents\pos459.tmp
C:\Documents and Settings\Pwner\My Documents\pos45A.tmp
C:\Documents and Settings\Pwner\My Documents\pos45B.tmp
C:\Documents and Settings\Pwner\My Documents\pos45C.tmp
C:\Documents and Settings\Pwner\My Documents\pos45D.tmp
C:\Documents and Settings\Pwner\My Documents\pos45E.tmp
C:\Documents and Settings\Pwner\My Documents\pos45F.tmp
C:\Documents and Settings\Pwner\My Documents\pos460.tmp
C:\Documents and Settings\Pwner\My Documents\pos461.tmp
C:\Documents and Settings\Pwner\My Documents\pos462.tmp
C:\Documents and Settings\Pwner\My Documents\pos463.tmp
C:\Documents and Settings\Pwner\My Documents\pos464.tmp
C:\Documents and Settings\Pwner\My Documents\pos465.tmp
C:\Documents and Settings\Pwner\My Documents\pos466.tmp
C:\Documents and Settings\Pwner\My Documents\pos467.tmp
C:\Documents and Settings\Pwner\My Documents\pos468.tmp
C:\Documents and Settings\Pwner\My Documents\pos469.tmp
C:\Documents and Settings\Pwner\My Documents\pos46A.tmp
C:\Documents and Settings\Pwner\My Documents\pos46B.tmp
C:\Documents and Settings\Pwner\My Documents\pos46C.tmp
C:\Documents and Settings\Pwner\My Documents\pos46D.tmp
C:\Documents and Settings\Pwner\My Documents\pos46E.tmp
C:\Documents and Settings\Pwner\My Documents\pos46F.tmp
C:\Documents and Settings\Pwner\My Documents\pos470.tmp
C:\Documents and Settings\Pwner\My Documents\pos471.tmp
C:\Documents and Settings\Pwner\My Documents\pos472.tmp
C:\Documents and Settings\Pwner\My Documents\pos473.tmp
C:\Documents and Settings\Pwner\My Documents\pos474.tmp
C:\Documents and Settings\Pwner\My Documents\pos475.tmp
C:\Documents and Settings\Pwner\My Documents\pos476.tmp
C:\Documents and Settings\Pwner\My Documents\pos477.tmp
C:\Documents and Settings\Pwner\My Documents\pos478.tmp
C:\Documents and Settings\Pwner\My Documents\pos479.tmp
C:\Documents and Settings\Pwner\My Documents\pos47A.tmp
C:\Documents and Settings\Pwner\My Documents\pos47B.tmp
C:\Documents and Settings\Pwner\My Documents\pos47C.tmp
C:\Documents and Settings\Pwner\My Documents\pos47D.tmp
C:\Documents and Settings\Pwner\My Documents\pos47E.tmp
C:\Documents and Settings\Pwner\My Documents\pos47F.tmp
C:\Documents and Settings\Pwner\My Documents\pos480.tmp
C:\Documents and Settings\Pwner\My Documents\pos481.tmp
C:\Documents and Settings\Pwner\My Documents\pos482.tmp
C:\Documents and Settings\Pwner\My Documents\pos483.tmp
C:\Documents and Settings\Pwner\My Documents\pos484.tmp
C:\Documents and Settings\Pwner\My Documents\pos485.tmp
C:\Documents and Settings\Pwner\My Documents\pos486.tmp
C:\Documents and Settings\Pwner\My Documents\pos487.tmp
C:\Documents and Settings\Pwner\My Documents\pos488.tmp
C:\Documents and Settings\Pwner\My Documents\pos489.tmp
C:\Documents and Settings\Pwner\My Documents\pos48A.tmp
C:\Documents and Settings\Pwner\My Documents\pos48B.tmp
C:\Documents and Settings\Pwner\My Documents\pos48C.tmp
C:\Documents and Settings\Pwner\My Documents\pos48D.tmp
C:\Documents and Settings\Pwner\My Documents\pos48E.tmp
C:\Documents and Settings\Pwner\My Documents\pos48F.tmp
C:\Documents and Settings\Pwner\My Documents\pos490.tmp
C:\Documents and Settings\Pwner\My Documents\pos491.tmp
C:\Documents and Settings\Pwner\My Documents\pos492.tmp
C:\Documents and Settings\Pwner\My Documents\pos493.tmp
C:\Documents and Settings\Pwner\My Documents\pos494.tmp
C:\Documents and Settings\Pwner\My Documents\pos495.tmp
C:\Documents and Settings\Pwner\My Documents\pos496.tmp
C:\Documents and Settings\Pwner\My Documents\pos497.tmp
C:\Documents and Settings\Pwner\My Documents\pos498.tmp
C:\Documents and Settings\Pwner\My Documents\pos499.tmp
C:\Documents and Settings\Pwner\My Documents\pos49A.tmp
C:\Documents and Settings\Pwner\My Documents\pos49B.tmp
C:\Documents and Settings\Pwner\My Documents\pos49C.tmp
C:\Documents and Settings\Pwner\My Documents\pos49D.tmp
C:\Documents and Settings\Pwner\My Documents\pos49E.tmp
C:\Documents and Settings\Pwner\My Documents\pos49F.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A0.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A1.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A2.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A3.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A4.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A5.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A6.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A7.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A8.tmp
C:\Documents and Settings\Pwner\My Documents\pos4A9.tmp
C:\Documents and Settings\Pwner\My Documents\pos4AA.tmp
C:\Documents and Settings\Pwner\My Documents\pos4AB.tmp
C:\Documents and Settings\Pwner\My Documents\pos4AC.tmp
C:\Documents and Settings\Pwner\My Documents\pos4AD.tmp
C:\Documents and Settings\Pwner\My Documents\pos4AE.tmp
C:\Documents and Settings\Pwner\My Documents\pos4AF.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B0.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B1.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B2.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B3.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B4.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B5.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B6.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B7.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B8.tmp
C:\Documents and Settings\Pwner\My Documents\pos4B9.tmp
C:\Documents and Settings\Pwner\My Documents\pos4BA.tmp
C:\Documents and Settings\Pwner\My Documents\pos4BB.tmp
C:\Documents and Settings\Pwner\My Documents\pos4BC.tmp
C:\Documents and Settings\Pwner\My Documents\pos4BD.tmp
C:\Documents and Settings\Pwner\My Documents\pos4BE.tmp
C:\Documents and Settings\Pwner\My Documents\pos4BF.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C0.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C1.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C2.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C3.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C4.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C5.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C6.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C7.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C8.tmp
C:\Documents and Settings\Pwner\My Documents\pos4C9.tmp
C:\Documents and Settings\Pwner\My Documents\pos4CA.tmp
C:\Documents and Settings\Pwner\My Documents\pos4CB.tmp
C:\Documents and Settings\Pwner\My Documents\pos4CC.tmp
C:\Documents and Settings\Pwner\My Documents\pos4CD.tmp
C:\Documents and Settings\Pwner\My Documents\pos4CE.tmp
C:\Documents and Settings\Pwner\My Documents\pos4CF.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D0.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D1.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D2.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D3.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D4.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D5.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D6.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D7.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D8.tmp
C:\Documents and Settings\Pwner\My Documents\pos4D9.tmp
C:\Documents and Settings\Pwner\My Documents\pos4DA.tmp
C:\Documents and Settings\Pwner\My Documents\pos4DB.tmp
C:\Documents and Settings\Pwner\My Documents\pos4DC.tmp
C:\Documents and Settings\Pwner\My Documents\pos4DD.tmp
C:\Documents and Settings\Pwner\My Documents\pos4DE.tmp
C:\Documents and Settings\Pwner\My Documents\pos4DF.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E0.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E1.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E2.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E3.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E4.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E5.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E6.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E7.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E8.tmp
C:\Documents and Settings\Pwner\My Documents\pos4E9.tmp
C:\Documents and Settings\Pwner\My Documents\pos4EA.tmp
C:\Documents and Settings\Pwner\My Documents\pos4EB.tmp
C:\Documents and Settings\Pwner\My Documents\pos4EC.tmp
C:\Documents and Settings\Pwner\My Documents\pos4ED.tmp
C:\Documents and Settings\Pwner\My Documents\pos4EE.tmp
C:\Documents and Settings\Pwner\My Documents\pos4EF.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F0.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F1.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F2.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F3.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F4.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F5.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F6.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F7.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F8.tmp
C:\Documents and Settings\Pwner\My Documents\pos4F9.tmp
C:\Documents and Settings\Pwner\My Documents\pos4FA.tmp
C:\Documents and Settings\Pwner\My Documents\pos4FB.tmp
C:\Documents and Settings\Pwner\My Documents\pos4FC.tmp
C:\Documents and Settings\Pwner\My Documents\pos4FD.tmp
C:\Documents and Settings\Pwner\My Documents\pos4FE.tmp
C:\Documents and Settings\Pwner\My Documents\pos4FF.tmp
C:\Documents and Settings\Pwner\My Documents\pos500.tmp
C:\Documents and Settings\Pwner\My Documents\pos501.tmp
C:\Documents and Settings\Pwner\My Documents\pos502.tmp
C:\Documents and Settings\Pwner\My Documents\pos503.tmp
C:\Documents and Settings\Pwner\My Documents\pos504.tmp
C:\Documents and Settings\Pwner\My Documents\pos505.tmp
C:\Documents and Settings\Pwner\My Documents\pos506.tmp
C:\Documents and Settings\Pwner\My Documents\pos507.tmp
C:\Documents and Settings\Pwner\My Documents\pos508.tmp
C:\Documents and Settings\Pwner\My Documents\pos509.tmp
C:\Documents and Settings\Pwner\My Documents\pos50A.tmp
C:\Documents and Settings\Pwner\My Documents\pos50B.tmp
C:\Documents and Settings\Pwner\My Documents\pos50C.tmp
C:\Documents and Settings\Pwner\My Documents\pos50D.tmp
C:\Documents and Settings\Pwner\My Documents\pos50E.tmp
C:\Documents and Settings\Pwner\My Documents\pos50F.tmp
C:\Documents and Settings\Pwner\My Documents\pos510.tmp
C:\Documents and Settings\Pwner\My Documents\pos511.tmp
C:\Documents and Settings\Pwner\My Documents\pos512.tmp
C:\Documents and Settings\Pwner\My Documents\pos513.tmp
C:\Documents and Settings\Pwner\My Documents\pos514.tmp
C:\Documents and Settings\Pwner\My Documents\pos515.tmp
C:\Documents and Settings\Pwner\My Documents\pos516.tmp
C:\Documents and Settings\Pwner\My Documents\pos517.tmp
C:\Documents and Settings\Pwner\My Documents\pos518.tmp
C:\Documents and Settings\Pwner\My Documents\pos519.tmp
C:\Documents and Settings\Pwner\My Documents\pos51A.tmp
C:\Documents and Settings\Pwner\My Documents\pos51B.tmp
C:\Documents and Settings\Pwner\My Documents\pos51C.tmp
C:\Documents and Settings\Pwner\My Documents\pos51D.tmp
C:\Documents and Settings\Pwner\My Documents\pos51E.tmp
C:\Documents and Settings\Pwner\My Documents\pos51F.tmp
C:\Documents and Settings\Pwner\My Documents\pos520.tmp
C:\Documents and Settings\Pwner\My Documents\pos521.tmp
C:\Documents and Settings\Pwner\My Documents\pos522.tmp
C:\Documents and Settings\Pwner\My Documents\pos523.tmp
C:\Documents and Settings\Pwner\My Documents\pos524.tmp
C:\Documents and Settings\Pwner\My Documents\pos525.tmp
C:\Documents and Settings\Pwner\My Documents\pos526.tmp
C:\Documents and Settings\Pwner\My Documents\pos527.tmp
C:\Documents and Settings\Pwner\My Documents\pos528.tmp
C:\Documents and Settings\Pwner\My Documents\pos529.tmp
C:\Documents and Settings\Pwner\My Documents\pos52A.tmp
C:\Documents and Settings\Pwner\My Documents\pos52B.tmp
C:\Documents and Settings\Pwner\My Documents\pos52C.tmp
C:\Documents and Settings\Pwner\My Documents\pos52D.tmp
C:\Documents and Settings\Pwner\My Documents\pos52E.tmp
C:\Documents and Settings\Pwner\My Documents\pos52F.tmp
C:\Documents and Settings\Pwner\My Documents\pos530.tmp
C:\Documents and Settings\Pwner\My Documents\pos531.tmp
C:\Documents and Settings\Pwner\My Documents\pos532.tmp
C:\Documents and Settings\Pwner\My Documents\pos533.tmp
C:\Documents and Settings\Pwner\My Documents\pos534.tmp
C:\Documents and Settings\Pwner\My Documents\pos535.tmp
C:\Documents and Settings\Pwner\My Documents\pos536.tmp
C:\Documents and Settings\Pwner\My Documents\pos537.tmp
C:\Documents and Settings\Pwner\My Documents\pos538.tmp
C:\Documents and Settings\Pwner\My Documents\pos539.tmp
C:\Documents and Settings\Pwner\My Documents\pos53A.tmp
C:\Documents and Settings\Pwner\My Documents\pos53B.tmp
C:\Documents and Settings\Pwner\My Documents\pos53C.tmp
C:\Documents and Settings\Pwner\My Documents\pos53D.tmp
C:\Documents and Settings\Pwner\My Documents\pos53E.tmp
C:\Documents and Settings\Pwner\My Documents\pos53F.tmp
C:\Documents and Settings\Pwner\My Documents\pos540.tmp
C:\Documents and Settings\Pwner\My Documents\pos541.tmp
C:\Documents and Settings\Pwner\My Documents\pos542.tmp
C:\Documents and Settings\Pwner\My Documents\pos543.tmp
C:\Documents and Settings\Pwner\My Documents\pos544.tmp
C:\Documents and Settings\Pwner\My Documents\pos545.tmp
C:\Documents and Settings\Pwner\My Documents\pos546.tmp
C:\Documents and Settings\Pwner\My Documents\pos547.tmp
C:\Documents and Settings\Pwner\My Documents\pos548.tmp
C:\Documents and Settings\Pwner\My Documents\pos549.tmp
C:\Documents and Settings\Pwner\My Documents\pos54A.tmp
C:\Documents and Settings\Pwner\My Documents\pos54B.tmp
C:\Documents and Settings\Pwner\My Documents\pos54C.tmp
C:\Documents and Settings\Pwner\My Documents\pos54D.tmp
C:\Documents and Settings\Pwner\My Documents\pos54E.tmp
C:\Documents and Settings\Pwner\My Documents\pos54F.tmp
C:\Documents and Settings\Pwner\My Documents\pos550.tmp
C:\Documents and Settings\Pwner\My Documents\pos551.tmp
C:\Documents and Settings\Pwner\My Documents\pos552.tmp
C:\Documents and Settings\Pwner\My Documents\pos553.tmp
C:\Documents and Settings\Pwner\My Documents\pos554.tmp
C:\Documents and Settings\Pwner\My Documents\pos555.tmp
C:\Documents and Settings\Pwner\My Documents\pos556.tmp
C:\Documents and Settings\Pwner\My Documents\pos557.tmp
C:\Documents and Settings\Pwner\My Documents\pos558.tmp
C:\Documents and Settings\Pwner\My Documents\pos559.tmp
C:\Documents and Settings\Pwner\My Documents\pos55A.tmp
C:\Documents and Settings\Pwner\My Documents\pos55B.tmp
C:\Documents and Settings\Pwner\My Documents\pos55C.tmp
C:\Documents and Settings\Pwner\My Documents\pos55D.tmp
C:\Documents and Settings\Pwner\My Documents\pos55E.tmp
C:\Documents and Settings\Pwner\My Documents\pos55F.tmp
C:\Documents and Settings\Pwner\My Documents\pos560.tmp
C:\Documents and Settings\Pwner\My Documents\pos561.tmp
C:\Documents and Settings\Pwner\My Documents\pos562.tmp
C:\Documents and Settings\Pwner\My Documents\pos563.tmp
C:\Documents and Settings\Pwner\My Documents\pos564.tmp
C:\Documents and Settings\Pwner\My Documents\pos565.tmp
C:\Documents and Settings\Pwner\My Documents\pos566.tmp
C:\Documents and Settings\Pwner\My Documents\pos567.tmp
C:\Documents and Settings\Pwner\My Documents\pos568.tmp
C:\Documents and Settings\Pwner\My Documents\pos569.tmp
C:\Documents and Settings\Pwner\My Documents\pos56A.tmp
C:\Documents and Settings\Pwner\My Documents\pos56B.tmp
C:\Documents and Settings\Pwner\My Documents\pos56C.tmp
C:\Documents and Settings\Pwner\My Documents\pos56D.tmp
C:\Documents and Settings\Pwner\My Documents\pos56E.tmp
C:\Documents and Settings\Pwner\My Documents\pos56F.tmp
C:\Documents and Settings\Pwner\My Documents\pos570.tmp
C:\Documents and Settings\Pwner\My Documents\pos571.tmp
C:\Documents and Settings\Pwner\My Documents\pos572.tmp
C:\Documents and Settings\Pwner\My Documents\pos573.tmp
C:\Documents and Settings\Pwner\My Documents\pos574.tmp
C:\Documents and Settings\Pwner\My Documents\pos575.tmp
C:\Documents and Settings\Pwner\My Documents\pos576.tmp
C:\Documents and Settings\Pwner\My Documents\pos577.tmp
C:\Documents and Settings\Pwner\My Documents\pos578.tmp
C:\Documents and Settings\Pwner\My Documents\pos579.tmp
C:\Documents and Settings\Pwner\My Documents\pos57A.tmp
C:\Documents and Settings\Pwner\My Documents\pos57B.tmp
C:\Documents and Settings\Pwner\My Documents\pos57C.tmp
C:\Documents and Settings\Pwner\My Documents\pos57D.tmp
C:\Documents and Settings\Pwner\My Documents\pos57E.tmp
C:\Documents and Settings\Pwner\My Documents\pos57F.tmp
C:\Documents and Settings\Pwner\My Documents\pos580.tmp
C:\Documents and Settings\Pwner\My Documents\pos581.tmp
C:\Documents and Settings\Pwner\My Documents\pos582.tmp
C:\Documents and Settings\Pwner\My Documents\pos583.tmp
C:\Documents and Settings\Pwner\My Documents\pos584.tmp
C:\Documents and Settings\Pwner\My Documents\pos585.tmp
C:\Documents and Settings\Pwner\My Documents\pos586.tmp
C:\Documents and Settings\Pwner\My Documents\pos587.tmp
C:\Documents and Settings\Pwner\My Documents\pos588.tmp
C:\Documents and Settings\Pwner\My Documents\pos589.tmp
C:\Documents and Settings\Pwner\My Documents\pos58A.tmp
C:\Documents and Settings\Pwner\My Documents\pos58B.tmp
C:\Documents and Settings\Pwner\My Documents\pos58C.tmp
C:\Documents and Settings\Pwner\My Documents\pos58D.tmp
C:\Documents and Settings\Pwner\My Documents\pos58E.tmp
C:\Documents and Settings\Pwner\My Documents\pos58F.tmp
C:\Documents and Settings\Pwner\My Documents\pos590.tmp
C:\Documents and Settings\Pwner\My Documents\pos591.tmp
C:\Documents and Settings\Pwner\My Documents\pos592.tmp
C:\Documents and Settings\Pwner\My Documents\pos593.tmp
C:\Documents and Settings\Pwner\My Documents\pos594.tmp
C:\Documents and Settings\Pwner\My Documents\pos595.tmp
C:\Documents and Settings\Pwner\My Documents\pos596.tmp
C:\Documents and Settings\Pwner\My Documents\pos597.tmp
C:\Documents and Settings\Pwner\My Documents\pos598.tmp
C:\Documents and Settings\Pwner\My Documents\pos599.tmp
C:\Documents and Settings\Pwner\My Documents\pos59A.tmp
C:\Documents and Settings\Pwner\My Documents\pos59B.tmp
C:\Documents and Settings\Pwner\My Documents\pos59C.tmp
C:\Documents and Settings\Pwner\My Documents\pos59D.tmp
C:\Documents and Settings\Pwner\My Documents\pos59E.tmp
C:\Documents and Settings\Pwner\My Documents\pos59F.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A0.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A1.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A2.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A3.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A4.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A5.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A6.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A7.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A8.tmp
C:\Documents and Settings\Pwner\My Documents\pos5A9.tmp
C:\Documents and Settings\Pwner\My Documents\pos5AA.tmp
C:\Documents and Settings\Pwner\My Documents\pos5AB.tmp
C:\Documents and Settings\Pwner\My Documents\pos5AC.tmp
C:\Documents and Settings\Pwner\My Documents\pos5AD.tmp
C:\Documents and Settings\Pwner\My Documents\pos5AE.tmp
C:\Documents and Settings\Pwner\My Documents\pos5AF.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B0.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B1.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B2.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B3.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B4.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B5.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B6.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B7.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B8.tmp
C:\Documents and Settings\Pwner\My Documents\pos5B9.tmp
C:\Documents and Settings\Pwner\My Documents\pos5BA.tmp
C:\Documents and Settings\Pwner\My Documents\pos5BB.tmp
C:\Documents and Settings\Pwner\My Documents\pos5BC.tmp
C:\Documents and Settings\Pwner\My Documents\pos5BD.tmp
C:\Documents and Settings\Pwner\My Documents\pos5BE.tmp
C:\Documents and Settings\Pwner\My Documents\pos5BF.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C0.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C1.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C2.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C3.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C4.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C5.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C6.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C7.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C8.tmp
C:\Documents and Settings\Pwner\My Documents\pos5C9.tmp
C:\Documents and Settings\Pwner\My Documents\pos5CA.tmp
C:\Documents and Settings\Pwner\My Documents\pos5CB.tmp
C:\Documents and Settings\Pwner\My Documents\pos5CC.tmp
C:\Documents and Settings\Pwner\My Documents\pos5CD.tmp
C:\Documents and Settings\Pwner\My Documents\pos5CE.tmp
C:\Documents and Settings\Pwner\My Documents\pos5CF.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D0.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D1.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D2.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D3.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D4.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D5.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D6.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D7.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D8.tmp
C:\Documents and Settings\Pwner\My Documents\pos5D9.tmp
C:\Documents and Settings\Pwner\My Documents\pos5DA.tmp
C:\Documents and Settings\Pwner\My Documents\pos5DB.tmp
C:\Documents and Settings\Pwner\My Documents\pos5DC.tmp
C:\Documents and Settings\Pwner\My Documents\pos5DD.tmp
C:\Documents and Settings\Pwner\My Documents\pos5DE.tmp
C:\Documents and Settings\Pwner\My Documents\pos5DF.tmp
C:\Documents and Settings\Pwner\My Documents\pos5E0.tmp
C:\pos10.tmp
C:\pos100.tmp
C:\pos101.tmp
C:\pos102.tmp
C:\pos103.tmp
C:\pos104.tmp
C:\pos105.tmp
C:\pos106.tmp
C:\pos107.tmp
C:\pos108.tmp
C:\pos109.tmp
C:\pos10A.tmp
C:\pos10B.tmp
C:\pos10C.tmp
C:\pos10D.tmp
C:\pos10E.tmp
C:\pos10F.tmp
C:\pos11.tmp
C:\pos110.tmp
C:\pos111.tmp
C:\pos112.tmp
C:\pos113.tmp
C:\pos114.tmp
C:\pos115.tmp
C:\pos116.tmp
C:\pos117.tmp
C:\pos118.tmp
C:\pos119.tmp
C:\pos11A.tmp
C:\pos11B.tmp
C:\pos11C.tmp
C:\pos11D.tmp
C:\pos11E.tmp
C:\pos11F.tmp
C:\pos12.tmp
C:\pos120.tmp
C:\pos121.tmp
C:\pos122.tmp
C:\pos123.tmp
C:\pos124.tmp
C:\pos125.tmp
C:\pos126.tmp
C:\pos127.tmp
C:\pos128.tmp
C:\pos129.tmp
C:\pos12A.tmp
C:\pos12B.tmp
C:\pos12C.tmp
C:\pos12D.tmp
C:\pos12E.tmp
C:\pos12F.tmp
C:\pos13.tmp
C:\pos130.tmp
C:\pos131.tmp
C:\pos132.tmp
C:\pos133.tmp
C:\pos134.tmp
C:\pos135.tmp
C:\pos136.tmp
C:\pos137.tmp
C:\pos138.tmp
C:\pos139.tmp
C:\pos13A.tmp
C:\pos13B.tmp
C:\pos13C.tmp
C:\pos13D.tmp
C:\pos13E.tmp
C:\pos13F.tmp
C:\pos14.tmp
C:\pos140.tmp
C:\pos141.tmp
C:\pos142.tmp
C:\pos143.tmp
C:\pos144.tmp
C:\pos145.tmp
C:\pos146.tmp
C:\pos147.tmp
C:\pos148.tmp
C:\pos149.tmp
C:\pos14A.tmp
C:\pos14B.tmp
C:\pos14C.tmp
C:\pos14D.tmp
C:\pos14E.tmp
C:\pos14F.tmp
C:\pos15.tmp
C:\pos150.tmp
C:\pos151.tmp
C:\pos152.tmp
C:\pos153.tmp
C:\pos154.tmp
C:\pos155.tmp
C:\pos156.tmp
C:\pos157.tmp
C:\pos158.tmp
C:\pos159.tmp
C:\pos15A.tmp
C:\pos15B.tmp
C:\pos15C.tmp
C:\pos15D.tmp
C:\pos15E.tmp
C:\pos15F.tmp
C:\pos16.tmp
C:\pos160.tmp
C:\pos161.tmp
C:\pos162.tmp
C:\pos163.tmp
C:\pos164.tmp
C:\pos165.tmp
C:\pos166.tmp
C:\pos167.tmp
C:\pos168.tmp
C:\pos169.tmp
C:\pos16A.tmp
C:\pos16B.tmp
C:\pos16C.tmp
C:\pos16D.tmp
C:\pos16E.tmp
C:\pos16F.tmp
C:\pos17.tmp
C:\pos170.tmp
C:\pos171.tmp
C:\pos172.tmp
C:\pos173.tmp
C:\pos174.tmp
C:\pos175.tmp
C:\pos176.tmp
C:\pos177.tmp
C:\pos178.tmp
C:\pos179.tmp
C:\pos17A.tmp
C:\pos17B.tmp
C:\pos17C.tmp
C:\pos17D.tmp
C:\pos17E.tmp
C:\pos17F.tmp
C:\pos18.tmp
C:\pos180.tmp
C:\pos181.tmp
C:\pos182.tmp
C:\pos183.tmp
C:\pos184.tmp
C:\pos185.tmp
C:\pos186.tmp
C:\pos187.tmp
C:\pos188.tmp
C:\pos189.tmp
C:\pos18A.tmp
C:\pos18B.tmp
C:\pos18C.tmp
C:\pos18D.tmp
C:\pos18E.tmp
C:\pos18F.tmp
C:\pos19.tmp
C:\pos190.tmp
C:\pos191.tmp
C:\pos192.tmp
C:\pos193.tmp
C:\pos194.tmp
C:\pos195.tmp
C:\pos196.tmp
C:\pos197.tmp
C:\pos198.tmp
C:\pos199.tmp
C:\pos19A.tmp
C:\pos19B.tmp
C:\pos19C.tmp
C:\pos19D.tmp
C:\pos19E.tmp
C:\pos19F.tmp
C:\pos1A.tmp
C:\pos1A0.tmp
C:\pos1A1.tmp
C:\pos1A2.tmp
C:\pos1A3.tmp
C:\pos1A4.tmp
C:\pos1A5.tmp
C:\pos1A6.tmp
C:\pos1A7.tmp
C:\pos1A8.tmp
C:\pos1A9.tmp
C:\pos1AA.tmp
C:\pos1AB.tmp
C:\pos1AC.tmp
C:\pos1AD.tmp
C:\pos1AE.tmp
C:\pos1AF.tmp
C:\pos1B.tmp
C:\pos1B0.tmp
C:\pos1B1.tmp
C:\pos1B2.tmp
C:\pos1B3.tmp
C:\pos1B4.tmp
C:\pos1B5.tmp
C:\pos1B6.tmp
C:\pos1B7.tmp
C:\pos1B8.tmp
C:\pos1B9.tmp
C:\pos1BA.tmp
C:\pos1BB.tmp
C:\pos1BC.tmp
C:\pos1BD.tmp
C:\pos1BE.tmp
C:\pos1BF.tmp
C:\pos1C.tmp
C:\pos1C0.tmp
C:\pos1C1.tmp
C:\pos1C2.tmp
C:\pos1C3.tmp
C:\pos1C4.tmp
C:\pos1C5.tmp
C:\pos1C6.tmp
C:\pos1C7.tmp
C:\pos1C8.tmp
C:\pos1C9.tmp
C:\pos1CA.tmp
C:\pos1CB.tmp
C:\pos1CC.tmp
C:\pos1CD.tmp
C:\pos1CE.tmp
C:\pos1CF.tmp
C:\pos1D.tmp
C:\pos1D0.tmp
C:\pos1D1.tmp
C:\pos1D2.tmp
C:\pos1D3.tmp
C:\pos1D4.tmp
C:\pos1D5.tmp
C:\pos1D6.tmp
C:\pos1D7.tmp
C:\pos1D8.tmp
C:\pos1D9.tmp
C:\pos1DA.tmp
C:\pos1DB.tmp
C:\pos1DC.tmp
C:\pos1DD.tmp
C:\pos1DE.tmp
C:\pos1DF.tmp
C:\pos1E.tmp
C:\pos1E0.tmp
C:\pos1E1.tmp
C:\pos1E2.tmp
C:\pos1E3.tmp
C:\pos1E4.tmp
C:\pos1E5.tmp
C:\pos1E6.tmp
C:\pos1E7.tmp
C:\pos1E8.tmp
C:\pos1E9.tmp
C:\pos1EA.tmp
C:\pos1EB.tmp
C:\pos1EC.tmp
C:\pos1ED.tmp
C:\pos1EE.tmp
C:\pos1EF.tmp
C:\pos1F.tmp
C:\pos1F0.tmp
C:\pos1F1.tmp
C:\pos1F2.tmp
C:\pos1F3.tmp
C:\pos1F4.tmp
C:\pos1F5.tmp
C:\pos1F6.tmp
C:\pos1F7.tmp
C:\pos1F8.tmp
C:\pos1F9.tmp
C:\pos1FA.tmp
C:\pos1FB.tmp
C:\pos1FC.tmp
C:\pos1FD.tmp
C:\pos1FE.tmp
C:\pos1FF.tmp
C:\pos20.tmp
C:\pos200.tmp
C:\pos201.tmp
C:\pos202.tmp
C:\pos203.tmp
C:\pos204.tmp
C:\pos205.tmp
C:\pos206.tmp
C:\pos207.tmp
C:\pos208.tmp
C:\pos209.tmp
C:\pos20A.tmp
C:\pos20B.tmp
C:\pos20C.tmp
C:\pos20D.tmp
C:\pos20E.tmp
C:\pos20F.tmp
C:\pos21.tmp
C:\pos210.tmp
C:\pos211.tmp
C:\pos212.tmp
C:\pos213.tmp
C:\pos214.tmp
C:\pos215.tmp
C:\pos216.tmp
C:\pos217.tmp
C:\pos218.tmp
C:\pos219.tmp
C:\pos21A.tmp
C:\pos21B.tmp
C:\pos21C.tmp
C:\pos21D.tmp
C:\pos21E.tmp
C:\pos21F.tmp
C:\pos22.tmp
C:\pos220.tmp
C:\pos221.tmp
C:\pos222.tmp
C:\pos223.tmp
C:\pos224.tmp
C:\pos225.tmp
C:\pos226.tmp
C:\pos227.tmp
C:\pos228.tmp
C:\pos229.tmp
C:\pos22A.tmp
C:\pos22B.tmp
C:\pos22C.tmp
C:\pos22D.tmp
C:\pos22E.tmp
C:\pos22F.tmp
C:\pos23.tmp
C:\pos230.tmp
C:\pos231.tmp
C:\pos232.tmp
C:\pos233.tmp
C:\pos234.tmp
C:\pos235.tmp
C:\pos236.tmp
C:\pos237.tmp
C:\pos238.tmp
C:\pos239.tmp
C:\pos23A.tmp
C:\pos23B.tmp
C:\pos23C.tmp
C:\pos23D.tmp
C:\pos23E.tmp
C:\pos23F.tmp
C:\pos24.tmp
C:\pos240.tmp
C:\pos241.tmp
C:\pos242.tmp
C:\pos243.tmp
C:\pos244.tmp
C:\pos245.tmp
C:\pos246.tmp
C:\pos247.tmp
C:\pos248.tmp
C:\pos249.tmp
C:\pos24A.tmp
C:\pos24B.tmp
C:\pos24C.tmp
C:\pos24D.tmp
C:\pos24E.tmp
C:\pos24F.tmp
C:\pos25.tmp
C:\pos250.tmp
C:\pos251.tmp
C:\pos252.tmp
C:\pos253.tmp
C:\pos254.tmp
C:\pos255.tmp
C:\pos256.tmp
C:\pos257.tmp
C:\pos258.tmp
C:\pos259.tmp
C:\pos25A.tmp
C:\pos25B.tmp
C:\pos25C.tmp
C:\pos25D.tmp
C:\pos25E.tmp
C:\pos25F.tmp
C:\pos26.tmp
C:\pos260.tmp
C:\pos261.tmp
C:\pos262.tmp
C:\pos263.tmp
C:\pos264.tmp
C:\pos265.tmp
C:\pos266.tmp
C:\pos267.tmp
C:\pos268.tmp
C:\pos269.tmp
C:\pos26A.tmp
C:\pos26B.tmp
C:\pos26C.tmp
C:\pos26D.tmp
C:\pos26E.tmp
C:\pos26F.tmp
C:\pos27.tmp
C:\pos270.tmp
C:\pos271.tmp
C:\pos272.tmp
C:\pos273.tmp
C:\pos274.tmp
C:\pos275.tmp
C:\pos276.tmp
C:\pos277.tmp
C:\pos278.tmp
C:\pos279.tmp
C:\pos27A.tmp
C:\pos27B.tmp
C:\pos27C.tmp
C:\pos27D.tmp
C:\pos27E.tmp
C:\pos27F.tmp
C:\pos28.tmp
C:\pos280.tmp
C:\pos281.tmp
C:\pos282.tmp
C:\pos283.tmp
C:\pos284.tmp
C:\pos285.tmp
C:\pos286.tmp
C:\pos287.tmp
C:\pos288.tmp
C:\pos289.tmp
C:\pos28A.tmp
C:\pos28B.tmp
C:\pos28C.tmp
C:\pos28D.tmp
C:\pos28E.tmp
C:\pos28F.tmp
C:\pos29.tmp
C:\pos290.tmp
C:\pos291.tmp
C:\pos292.tmp
C:\pos293.tmp
C:\pos294.tmp
C:\pos295.tmp
C:\pos296.tmp
C:\pos297.tmp
C:\pos298.tmp
C:\pos299.tmp
C:\pos29A.tmp
C:\pos29B.tmp
C:\pos29C.tmp
C:\pos29D.tmp
C:\pos29E.tmp
C:\pos29F.tmp
C:\pos2A.tmp
C:\pos2A0.tmp
C:\pos2A1.tmp
C:\pos2A2.tmp
C:\pos2A3.tmp
C:\pos2A4.tmp
C:\pos2A5.tmp
C:\pos2A6.tmp
C:\pos2A7.tmp
C:\pos2A8.tmp
C:\pos2A9.tmp
C:\pos2AA.tmp
C:\pos2AB.tmp
C:\pos2AC.tmp
C:\pos2AD.tmp
C:\pos2AE.tmp
C:\pos2AF.tmp
C:\pos2B.tmp
C:\pos2B0.tmp
C:\pos2B1.tmp
C:\pos2B2.tmp
C:\pos2B3.tmp
C:\pos2B4.tmp
C:\pos2B5.tmp
C:\pos2B6.tmp
C:\pos2B7.tmp
C:\pos2B8.tmp
C:\pos2B9.tmp
C:\pos2BA.tmp
C:\pos2BB.tmp
C:\pos2BC.tmp
C:\pos2BD.tmp
C:\pos2BE.tmp
C:\pos2BF.tmp
C:\pos2C.tmp
C:\pos2C0.tmp
C:\pos2C1.tmp
C:\pos2C2.tmp
C:\pos2C3.tmp
C:\pos2C4.tmp
C:\pos2C5.tmp
C:\pos2C6.tmp
C:\pos2C7.tmp
C:\pos2C8.tmp
C:\pos2C9.tmp
C:\pos2CA.tmp
C:\pos2CB.tmp
C:\pos2CC.tmp
C:\pos2CD.tmp
C:\pos2CE.tmp
C:\pos2CF.tmp
C:\pos2D.tmp
C:\pos2D0.tmp
C:\pos2D1.tmp
C:\pos2D2.tmp
C:\pos2D3.tmp
C:\pos2D4.tmp
C:\pos2D5.tmp
C:\pos2D6.tmp
C:\pos2D7.tmp
C:\pos2D8.tmp
C:\pos2D9.tmp
C:\pos2DA.tmp
C:\pos2DB.tmp
C:\pos2DC.tmp
C:\pos2DD.tmp
C:\pos2DE.tmp
C:\pos2DF.tmp
C:\pos2E.tmp
C:\pos2E0.tmp
C:\pos2E1.tmp
C:\pos2E2.tmp
C:\pos2E3.tmp
C:\pos2E4.tmp
C:\pos2E5.tmp
C:\pos2E6.tmp
C:\pos2E7.tmp
C:\pos2E8.tmp
C:\pos2E9.tmp
C:\pos2EA.tmp
C:\pos2EB.tmp
C:\pos2EC.tmp
C:\pos2ED.tmp
C:\pos2EE.tmp
C:\pos2EF.tmp
C:\pos2F.tmp
C:\pos2F0.tmp
C:\pos2F1.tmp
C:\pos2F2.tmp
C:\pos2F3.tmp
C:\pos2F4.tmp
C:\pos2F5.tmp
C:\pos2F6.tmp
C:\pos2F7.tmp
C:\pos2F8.tmp
C:\pos2F9.tmp
C:\pos2FA.tmp
C:\pos2FB.tmp
C:\pos2FC.tmp
C:\pos2FD.tmp
C:\pos2FE.tmp
C:\pos2FF.tmp
C:\pos30.tmp
C:\pos300.tmp
C:\pos301.tmp
C:\pos302.tmp
C:\pos303.tmp
C:\pos304.tmp
C:\pos305.tmp
C:\pos306.tmp
C:\pos307.tmp
C:\pos308.tmp
C:\pos309.tmp
C:\pos30A.tmp
C:\pos30B.tmp
C:\pos30C.tmp
C:\pos30D.tmp
C:\pos30E.tmp
C:\pos30F.tmp
C:\pos31.tmp
C:\pos310.tmp
C:\pos311.tmp
C:\pos312.tmp
C:\pos313.tmp
C:\pos314.tmp
C:\pos315.tmp
C:\pos316.tmp
C:\pos317.tmp
C:\pos318.tmp
C:\pos319.tmp
C:\pos31A.tmp
C:\pos31B.tmp
C:\pos31C.tmp
C:\pos31D.tmp
C:\pos31E.tmp
C:\pos31F.tmp
C:\pos32.tmp
C:\pos320.tmp
C:\pos321.tmp
C:\pos322.tmp
C:\pos323.tmp
C:\pos324.tmp
C:\pos325.tmp
C:\pos326.tmp
C:\pos327.tmp
C:\pos328.tmp
C:\pos329.tmp
C:\pos32A.tmp
C:\pos32B.tmp
C:\pos32C.tmp
C:\pos32D.tmp
C:\pos32E.tmp
C:\pos32F.tmp
C:\pos33.tmp
C:\pos330.tmp
C:\pos331.tmp
C:\pos332.tmp
C:\pos333.tmp
C:\pos334.tmp
C:\pos335.tmp
C:\pos336.tmp
C:\pos337.tmp
C:\pos338.tmp
C:\pos339.tmp
C:\pos33A.tmp
C:\pos33B.tmp
C:\pos33C.tmp
C:\pos33D.tmp
C:\pos33E.tmp
C:\pos33F.tmp
C:\pos34.tmp
C:\pos340.tmp
C:\pos341.tmp
C:\pos342.tmp
C:\pos343.tmp
C:\pos344.tmp
C:\pos345.tmp
C:\pos346.tmp
C:\pos347.tmp
C:\pos348.tmp
C:\pos349.tmp
C:\pos34A.tmp
C:\pos34B.tmp
C:\pos34C.tmp
C:\pos34D.tmp
C:\pos34E.tmp
C:\pos34F.tmp
C:\pos35.tmp
C:\pos350.tmp
C:\pos351.tmp
C:\pos352.tmp
C:\pos353.tmp
C:\pos354.tmp
C:\pos355.tmp
C:\pos356.tmp
C:\pos357.tmp
C:\pos358.tmp
C:\pos359.tmp
C:\pos35A.tmp
C:\pos35B.tmp
C:\pos35C.tmp
C:\pos35D.tmp
C:\pos35E.tmp
C:\pos35F.tmp
C:\pos36.tmp
C:\pos360.tmp
C:\pos361.tmp
C:\pos362.tmp
C:\pos363.tmp
C:\pos364.tmp
C:\pos365.tmp
C:\pos366.tmp
C:\pos367.tmp
C:\pos368.tmp
C:\pos369.tmp
C:\pos36A.tmp
C:\pos36B.tmp
C:\pos36C.tmp
C:\pos36D.tmp
C:\pos36E.tmp
C:\pos36F.tmp
C:\pos37.tmp
C:\pos370.tmp
C:\pos371.tmp
C:\pos372.tmp
C:\pos373.tmp
C:\pos374.tmp
C:\pos375.tmp
C:\pos376.tmp
C:\pos377.tmp
C:\pos378.tmp
C:\pos379.tmp
C:\pos37A.tmp
C:\pos37B.tmp
C:\pos37C.tmp
C:\pos37D.tmp
C:\pos37E.tmp
C:\pos37F.tmp
C:\pos38.tmp
C:\pos380.tmp
C:\pos381.tmp
C:\pos382.tmp
C:\pos383.tmp
C:\pos384.tmp
C:\pos385.tmp
C:\pos386.tmp
C:\pos387.tmp
C:\pos388.tmp
C:\pos389.tmp
C:\pos38A.tmp
C:\pos38B.tmp
C:\pos38C.tmp
C:\pos38D.tmp
C:\pos38E.tmp
C:\pos38F.tmp
C:\pos39.tmp
C:\pos390.tmp
C:\pos391.tmp
C:\pos392.tmp
C:\pos393.tmp
C:\pos394.tmp
C:\pos395.tmp
C:\pos396.tmp
C:\pos397.tmp
C:\pos398.tmp
C:\pos399.tmp
C:\pos39A.tmp
C:\pos39B.tmp
C:\pos39C.tmp
C:\pos39D.tmp
C:\pos39E.tmp
C:\pos39F.tmp
C:\pos3A.tmp
C:\pos3A0.tmp
C:\pos3A1.tmp
C:\pos3A2.tmp
C:\pos3A3.tmp
C:\pos3A4.tmp
C:\pos3A5.tmp
C:\pos3A6.tmp
C:\pos3A7.tmp
C:\pos3A8.tmp
C:\pos3A9.tmp
C:\pos3AA.tmp
C:\pos3AB.tmp
C:\pos3AC.tmp
C:\pos3AD.tmp
C:\pos3AE.tmp
C:\pos3AF.tmp
C:\pos3B.tmp
C:\pos3B0.tmp
C:\pos3B1.tmp
C:\pos3B2.tmp
C:\pos3B3.tmp
C:\pos3B4.tmp
C:\pos3B5.tmp
C:\pos3B6.tmp
C:\pos3B7.tmp
C:\pos3B8.tmp
C:\pos3B9.tmp
C:\pos3BA.tmp
C:\pos3BB.tmp
C:\pos3BC.tmp
C:\pos3BD.tmp
C:\pos3BE.tmp
C:\pos3BF.tmp
C:\pos3C.tmp
C:\pos3C0.tmp
C:\pos3C1.tmp
C:\pos3C2.tmp
C:\pos3C3.tmp
C:\pos3C4.tmp
C:\pos3C5.tmp
C:\pos3C6.tmp
C:\pos3C7.tmp
C:\pos3C8.tmp
C:\pos3C9.tmp
C:\pos3CA.tmp
C:\pos3CB.tmp
C:\pos3CC.tmp
C:\pos3CD.tmp
C:\pos3CE.tmp
C:\pos3CF.tmp
C:\pos3D.tmp
C:\pos3D0.tmp
C:\pos3D1.tmp
C:\pos3D2.tmp
C:\pos3D3.tmp
C:\pos3D4.tmp
C:\pos3D5.tmp
C:\pos3D6.tmp
C:\pos3D7.tmp
C:\pos3D8.tmp
C:\pos3D9.tmp
C:\pos3DA.tmp
C:\pos3DB.tmp
C:\pos3DC.tmp
C:\pos3DD.tmp
C:\pos3DE.tmp
C:\pos3DF.tmp
C:\pos3E.tmp
C:\pos3E0.tmp
C:\pos3E1.tmp
C:\pos3E2.tmp
C:\pos3E3.tmp
C:\pos3E4.tmp
C:\pos3E5.tmp
C:\pos3E6.tmp
C:\pos3E7.tmp
C:\pos3E8.tmp
C:\pos3E9.tmp
C:\pos3EA.tmp
C:\pos3EB.tmp
C:\pos3EC.tmp
C:\pos3F.tmp
C:\pos40.tmp
C:\pos41.tmp
C:\pos42.tmp
C:\pos43.tmp
C:\pos44.tmp
C:\pos45.tmp
C:\pos46.tmp
C:\pos47.tmp
C:\pos48.tmp
C:\pos49.tmp
C:\pos4A.tmp
C:\pos4B.tmp
C:\pos4C.tmp
C:\pos4D.tmp
C:\pos4E.tmp
C:\pos4F.tmp
C:\pos5.tmp
C:\pos50.tmp
C:\pos51.tmp
C:\pos52.tmp
C:\pos53.tmp
C:\pos54.tmp
C:\pos55.tmp
C:\pos56.tmp
C:\pos57.tmp
C:\pos58.tmp
C:\pos59.tmp
C:\pos5A.tmp
C:\pos5B.tmp
C:\pos5C.tmp
C:\pos5D.tmp
C:\pos5E.tmp
C:\pos5F.tmp
C:\pos6.tmp
C:\pos60.tmp
C:\pos61.tmp
C:\pos62.tmp
C:\pos63.tmp
C:\pos64.tmp
C:\pos65.tmp
C:\pos66.tmp
C:\pos67.tmp
C:\pos68.tmp
C:\pos69.tmp
C:\pos6A.tmp
C:\pos6B.tmp
C:\pos6C.tmp
C:\pos6D.tmp
C:\pos6E.tmp
C:\pos6F.tmp
C:\pos7.tmp
C:\pos70.tmp
C:\pos71.tmp
C:\pos72.tmp
C:\pos73.tmp
C:\pos74.tmp
C:\pos75.tmp
C:\pos76.tmp
C:\pos77.tmp
C:\pos78.tmp
C:\pos79.tmp
C:\pos7A.tmp
C:\pos7B.tmp
C:\pos7C.tmp
C:\pos7D.tmp
C:\pos7E.tmp
C:\pos7F.tmp
C:\pos8.tmp
C:\pos80.tmp
C:\pos81.tmp
C:\pos82.tmp
C:\pos83.tmp
C:\pos84.tmp
C:\pos85.tmp
C:\pos86.tmp
C:\pos87.tmp
C:\pos88.tmp
C:\pos89.tmp
C:\pos8A.tmp
C:\pos8B.tmp
C:\pos8C.tmp
C:\pos8D.tmp
C:\pos8E.tmp
C:\pos8F.tmp
C:\pos9.tmp
C:\pos90.tmp
C:\pos91.tmp
C:\pos92.tmp
C:\pos93.tmp
C:\pos94.tmp
C:\pos95.tmp
C:\pos96.tmp
C:\pos97.tmp
C:\pos98.tmp
C:\pos99.tmp
C:\pos9A.tmp
C:\pos9B.tmp
C:\pos9C.tmp
C:\pos9D.tmp
C:\pos9E.tmp
C:\pos9F.tmp
C:\posA.tmp
C:\posA0.tmp
C:\posA1.tmp
C:\posA2.tmp
C:\posA3.tmp
C:\posA4.tmp
C:\posA5.tmp
C:\posA6.tmp
C:\posA7.tmp
C:\posA8.tmp
C:\posA9.tmp
C:\posAA.tmp
C:\posAB.tmp
C:\posAC.tmp
C:\posAD.tmp
C:\posAE.tmp
C:\posAF.tmp
C:\posB.tmp
C:\posB0.tmp
C:\posB1.tmp
C:\posB2.tmp
C:\posB3.tmp
C:\posB4.tmp
C:\posB5.tmp
C:\posB6.tmp
C:\posB7.tmp
C:\posB8.tmp
C:\posB9.tmp
C:\posBA.tmp
C:\posBB.tmp
C:\posBC.tmp
C:\posBD.tmp
C:\posBE.tmp
C:\posBF.tmp
C:\posC.tmp
C:\posC0.tmp
C:\posC1.tmp
C:\posC2.tmp
C:\posC3.tmp
C:\posC4.tmp
C:\posC5.tmp
C:\posC6.tmp
C:\posC7.tmp
C:\posC8.tmp
C:\posC9.tmp
C:\posCA.tmp
C:\posCB.tmp
C:\posCC.tmp
C:\posCD.tmp
C:\posCE.tmp
C:\posCF.tmp
C:\posD.tmp
C:\posD0.tmp
C:\posD1.tmp
C:\posD2.tmp
C:\posD3.tmp
C:\posD4.tmp
C:\posD5.tmp
C:\posD6.tmp
C:\posD7.tmp
C:\posD8.tmp
C:\posD9.tmp
C:\posDA.tmp
C:\posDB.tmp
C:\posDC.tmp
C:\posDD.tmp
C:\posDE.tmp
C:\posDF.tmp
C:\posE.tmp
C:\posE0.tmp
C:\posE1.tmp
C:\posE2.tmp
C:\posE3.tmp
C:\posE4.tmp
C:\posE5.tmp
C:\posE6.tmp
C:\posE7.tmp
C:\posE8.tmp
C:\posE9.tmp
C:\posEA.tmp
C:\posEB.tmp
C:\posEC.tmp
C:\posED.tmp
C:\posEE.tmp
C:\posEF.tmp
C:\posF.tmp
C:\posF0.tmp
C:\posF1.tmp
C:\posF2.tmp
C:\posF3.tmp
C:\posF4.tmp
C:\posF5.tmp
C:\posF6.tmp
C:\posF7.tmp
C:\posF8.tmp
C:\posF9.tmp
C:\posFA.tmp
C:\posFB.tmp
C:\posFC.tmp
C:\posFD.tmp
C:\posFE.tmp
C:\posFF.tmp
C:\Program Files\MSN Gaming Zone\wuonykaxyv.html
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\b122.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\R2VvcmdlIEx1dHo\
C:\WINDOWS\R2VvcmdlIEx1dHo\\asappsrv.dll
C:\WINDOWS\R2VvcmdlIEx1dHo\\command.exe
C:\WINDOWS\R2VvcmdlIEx1dHo\\lZpSwAx5KHUYxJC.vbs
C:\WINDOWS\R2VvcmdlIEx1dHo\command.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\awuxccsg.dll
C:\WINDOWS\system32\ayadd.ini
C:\WINDOWS\system32\ayadd.ini2
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\ddaya.dll
C:\WINDOWS\system32\gimpzpob.dll
C:\WINDOWS\system32\gimpzpob.dllbox
C:\WINDOWS\system32\gsccxuwa.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\xhdnpffs.dll
C:\WINDOWS\uninstall_nmon.vbs

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CMDSERVICE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_NETWORK_MONITOR
——-\LEGACY_NPF
——-\cmdService
——-\Network Monitor


((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))
.

2008-01-17 00:21 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-17 00:16 . 2008-01-17 00:16 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-17 00:16 . 2008-01-17 00:16 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-16 22:37 . 2008-01-16 22:52 338,432 –a—— C:\WINDOWS\system32\ddaya.exe
2008-01-16 20:44 . 2008-01-16 20:44 d——– C:\Program Files\Uniblue
2008-01-16 20:44 . 2008-01-16 20:44 d——– C:\Documents and Settings\Administrator\Application Data\Uniblue
2008-01-16 19:14 . 2008-01-16 19:35 d——– C:\Program Files\MagicISO
2008-01-16 02:30 . 2008-01-16 22:59 166,064 –a—— C:\FixVundo.exe
2008-01-15 13:28 . 2008-01-15 13:38 d——– C:\Program Files\SymNetDrv
2008-01-15 13:01 . 2008-01-15 13:01 155,648 –a—— C:\WINDOWS\system32\NeroCheck .exe
2008-01-15 13:00 . 2008-01-15 14:21 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2008-01-15 12:53 . 2008-01-16 04:11 d——– C:\Program Files\Norton AntiVirus
2008-01-15 12:53 . 2008-01-15 13:03 d——– C:\Documents and Settings\Pwner\Application Data\Symantec
2008-01-15 12:53 . 2006-09-15 22:52 124,016 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-01-15 12:53 . 2006-09-15 22:52 91,904 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-01-15 12:53 . 2008-01-15 12:53 4,608 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
2008-01-15 12:52 . 2008-01-15 13:29 d——– C:\Program Files\Symantec
2008-01-15 12:52 . 2008-01-18 00:24 d——– C:\Program Files\Common Files\Symantec Shared
2008-01-15 12:52 . 2008-01-15 13:02 d——– C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-15 12:31 . 2008-01-15 12:31 d——– C:\WINDOWS\system32\xv2
2008-01-15 12:31 . 2008-01-15 12:31 d——– C:\WINDOWS\system32\edcA01
2008-01-15 12:31 . 2008-01-16 22:52 d——– C:\WINDOWS\system32\ap3
2008-01-15 12:31 . 2008-01-18 00:43 d——– C:\Temp
2008-01-15 12:31 . 2008-01-16 04:03 36,864 –a—— C:\WINDOWS\mrofinu572.exe.tmp
2008-01-13 22:11 . 2008-01-13 22:19 d——– C:\Program Files\HOMM3 (manual delete)
2008-01-12 04:49 . 2008-01-12 04:50 d——– C:\Program Files\Winamp
2008-01-12 04:49 . 2008-01-12 13:58 d——– C:\Documents and Settings\Pwner\Application Data\Winamp
2008-01-12 02:08 . 2004-05-14 10:12 1,916,928 ——— C:\WINDOWS\UNNVEContent.exe
2008-01-12 02:08 . 2004-11-30 12:14 67,990 ——— C:\WINDOWS\UNNVEContent.cfg
2008-01-11 15:26 . 1994-09-21 02:00 12,800 –a—— C:\WINDOWS\system\WING32.DLL
2008-01-11 15:17 . 2008-01-13 22:37 0 –a—— C:\~.~
2008-01-10 14:02 . 2008-01-10 14:02 d——– C:\Program Files\3DO
2008-01-10 14:02 . 1994-09-21 02:00 12,800 –a—— C:\WINDOWS\system32\WING32.DLL
2008-01-09 21:02 . 2004-08-04 00:56 159,232 –a—— C:\WINDOWS\system32\ptpusd.dll
2008-01-09 21:02 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-01-09 21:02 . 2004-08-03 22:58 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-01-09 21:02 . 2001-08-17 22:36 5,632 –a—— C:\WINDOWS\system32\ptpusb.dll
2008-01-04 23:54 . 2008-01-04 23:54 d——– C:\Program Files\Ventrilo
2008-01-04 23:53 . 2008-01-04 23:53 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-03 17:56 . 2008-01-03 17:56 d——– C:\Program Files\Teamspeak2_RC2
2008-01-03 17:56 . 2008-01-03 17:56 d——– C:\Documents and Settings\Pwner\Application Data\teamspeak2
2008-01-03 16:46 . 2008-01-03 16:46 8 –a—— C:\WINDOWS\system32\nvModes.dat
2008-01-03 16:29 . 2007-12-17 13:53 159,458 –a—— C:\WINDOWS\system32\nvapps.nvb
2008-01-01 21:35 . 2008-01-01 21:35 d——– C:\Program Files\AMD
2008-01-01 21:35 . 2005-03-09 15:53 36,352 –a—— C:\WINDOWS\system32\drivers\AmdK8.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 08:50 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-01-15 19:19 96,256 —-a-w C:\WINDOWS\system32\drivers\sptd5821.sys
2008-01-15 18:38 ——— d—–w C:\Program Files\Steam
2008-01-15 18:38 ——— d—–w C:\Program Files\MSN Messenger
2008-01-15 18:38 ——— d—–w C:\Program Files\DAEMON Tools
2008-01-15 18:37 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-15 17:32 ——— d—–w C:\Program Files\yPlay
2008-01-12 06:03 ——— d—–w C:\Documents and Settings\Pwner\Application Data\Ahead
2008-01-05 08:42 ——— d—–w C:\Program Files\SpeedFan
2008-01-03 22:52 ——— d—–w C:\Program Files\BitComet
2008-01-03 06:13 ——— d-s—w C:\Program Files\Xfire
2008-01-03 06:02 ——— d—–w C:\Documents and Settings\Pwner\Application Data\Xfire
2007-12-31 15:26 ——— d—–w C:\Program Files\VirtualDJ
2007-12-25 19:39 ——— d—–w C:\Program Files\Half Life Player
2007-12-10 02:15 ——— d—–w C:\Program Files\Cheat Engine
2007-12-08 21:18 ——— d—–w C:\Program Files\Ahead
2007-12-08 21:17 ——— d—–w C:\Program Files\Common Files\Nero
2007-12-08 21:15 ——— d—–w C:\Documents and Settings\All Users\Application Data\Ahead
2007-12-08 19:56 ——— d—–w C:\Program Files\Winamp2
2007-12-07 12:32 ——— d—–w C:\Documents and Settings\Pwner\Application Data\ScanSoft
2007-12-05 07:53 356,352 —-a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-05 06:41 81,920 —-a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 06:41 81,920 —-a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 06:41 8,523,776 —-a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 06:41 753,664 —-a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 06:41 7,435,392 —-a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 06:41 6,901,760 —-a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 06:41 6,549,504 —-a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 06:41 5,773,568 —-a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 06:41 466,944 —-a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 06:41 45,056 —-a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 06:41 442,368 —-a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 06:41 425,984 —-a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 06:41 385,024 —-a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 06:41 356,352 —-a-w C:\WINDOWS\system32\nvudisp.exe
2007-12-05 06:41 35,328 —-a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 06:41 35,328 —-a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 06:41 307,200 —-a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 06:41 3,710,976 —-a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 06:41 3,420,160 —-a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 06:41 286,720 —-a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 06:41 229,376 —-a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-05 06:41 2,498,560 —-a-w C:\WINDOWS\system32\nvwss.dll
2007-12-05 06:41 188,416 —-a-w C:\WINDOWS\system32\nvmccss.dll
2007-12-05 06:41 155,716 —-a-w C:\WINDOWS\system32\nvsvc32.exe
2007-12-05 06:41 147,456 —-a-w C:\WINDOWS\system32\nvcolor.exe
2007-12-05 06:41 1,703,936 —-a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 06:41 1,626,112 —-a-w C:\WINDOWS\system32\nwiz.exe
2007-12-05 06:41 1,474,560 —-a-w C:\WINDOWS\system32\nview.dll
2007-12-05 06:41 1,339,392 —-a-w C:\WINDOWS\system32\nvdspsch.exe
2007-12-05 06:41 1,228,800 —-a-w C:\WINDOWS\system32\nvmobls.dll
2007-12-05 06:41 1,089,536 —-a-w C:\WINDOWS\system32\nvcuda.dll
2007-12-05 06:41 1,019,904 —-a-w C:\WINDOWS\system32\nvwimg.dll
2007-11-28 00:10 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-28 00:08 ——— d—–w C:\Program Files\Common Files\Macrovision Shared
2007-11-27 21:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\SimCity Societies
2007-11-27 19:49 107,888 —-a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-11-27 19:49 ——— d–h–r C:\Documents and Settings\Pwner\Application Data\SecuROM
2007-11-27 19:32 ——— d—–w C:\Program Files\Electronic Arts
2006-05-03 09:06 163,328 –sha-r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 –sha-r C:\WINDOWS\system32\msfDX.dll
.
—-a-w			58,488 2008-01-15 18:01:34  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
—-a-w		   218,240 2008-01-15 18:01:35  C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt .exe
—-a-w		   133,016 2008-01-15 18:01:35  C:\Program Files\DAEMON Tools\daemon .exe
—-a-w		 5,674,352 2008-01-15 18:01:54  C:\Program Files\MSN Messenger\MsnMsgr .Exe
—-a-w		   148,608 2008-01-15 18:01:37  C:\Program Files\Norton AntiVirus\BootWarn .exe
—-a-w		   132,248 2008-01-15 18:01:35  C:\Program Files\Norton AntiVirus\CfgWiz .exe
—-a-w		 1,266,936 2008-01-15 18:01:48  C:\Program Files\Steam\steam .exe
—-a-w			15,360 2008-01-15 19:21:19  C:\WINDOWS\system32\ctfmon .exe
—-a-w		   155,648 2008-01-15 18:01:32  C:\WINDOWS\system32\NeroCheck .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{076AA728-4C4F-449E-7CBD-2DEF237F6FC2}]
2008-01-15 12:32 70144 –a—— C:\Program Files\MSN Gaming Zone\safuvefiw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{426EF433-3ED8-766C-ABC8-12A395FBFEB1}]
C:\WINDOWS\system32\jvjbr.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98186389-5EEA-4194-935C-EA8E79198D71}]
C:\Program Files\InstallShield Installation Information\posecud4444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b0b6eb26-2f0e-4a93-97f5-b93b9fc4b49c}]
C:\WINDOWS\system32\oipqeswc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B392BAA0-359E-4522-A2F1-3F3B76E8BFC2}]
C:\Program Files\InstallShield Installation Information\posecud83122.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm .exe" [ ]
"Steam"="c:\program files\steam\steam.exe" [ ]
"Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [ ]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [ ]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"NAV CfgWiz"="C:\Program Files\Norton AntiVirus\CfgWiz.exe" [ ]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgghefc]
hgghefc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 C:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2005-12-06 20:16 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Status Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk
backup=C:\WINDOWS\pss\Status Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TabUserW.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk
backup=C:\WINDOWS\pss\TabUserW.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
——— 2005-05-17 17:42 933888 C:\Program Files\Brother\ControlCenter2\brctrcen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
–a—— 2005-03-17 14:45 40960 C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2006-02-23 15:45 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
–a—— 2005-03-17 14:25 57393 C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSPVideo9]
–a—— 2005-10-29 19:56 606208 C:\Program Files\pspvideo9\pspVideo9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2006-11-14 12:00 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
——— 2005-01-26 18:02 49152 C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r——- 2005-08-17 05:39 90112 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
-ra—— 2003-10-14 10:22 155648 C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"mnmsrvc"=3 (0x3)
"TapiSrv"=3 (0x3)
"SPTISRV"=3 (0x3)
"NetMDSB"=2 (0x2)
"iPodService"=3 (0x3)
"PACSPTISVR"=3 (0x3)
"Brsonnmnp"=3 (0x3)
"Brother XP spl Service"=2 (0x2)

R0 ALLOW-IO;ALLOW-IO;C:\WINDOWS\system32\Drivers\ALLOW-IO.sys [2005-06-22 01:47]
S3 AIT100AS;VGA USB Camera Driver MI_00;C:\WINDOWS\system32\Drivers\AIT100S.sys [2004-04-23 13:54]
S3 AIT100AV;VGA USB Camera MI_01;C:\WINDOWS\system32\Drivers\AIT100V.sys [2004-04-23 13:54]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 08:05]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3 gAGP440p;gAGP440p;C:\DOCUME~1\Pwner\LOCALS~1\Temp\gAGP440p.sys []
S3 Memctl;Memctl;C:\Program Files\ABIT\FlashMenu\Memctl.sys [2001-11-29 18:49]
S3 qcmdmxp;HTC Proprietary USB Driver (PID 0B03);C:\WINDOWS\system32\DRIVERS\qcmdmxp.sys [2006-12-27 18:38]
S3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver;C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys [2001-08-17 13:02]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b6105c1-5f39-11d9-849d-806d6172696f}]
\Shell\AutoRun\command - D:\Atisetup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-15 18:05:40 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Pwner.job"
- C:\PROGRA~1\NORTON~1\Navw32.exeh/task:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 04:51:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-18 5:06:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-18 10:06:24
.
2007-10-26 01:20:19 — E O F —


and heres the HJT log


Logfile of HijackThis v1.99.1
Scan saved at 5:18:19 AM, on 18/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\MsiExec.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: 0 - {076AA728-4C4F-449E-7CBD-2DEF237F6FC2} - C:\Program Files\MSN Gaming Zone\safuvefiw.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: (no name) - {426EF433-3ED8-766C-ABC8-12A395FBFEB1} - C:\WINDOWS\system32\jvjbr.dll (file missing)
O2 - BHO: (no name) - {98186389-5EEA-4194-935C-EA8E79198D71} - C:\Program Files\InstallShield Installation Information\posecud4444.dll (file missing)
O2 - BHO: {c94b4cf9-b39b-5f79-39a4-e0f262be6b0b} - {b0b6eb26-2f0e-4a93-97f5-b93b9fc4b49c} - C:\WINDOWS\system32\oipqeswc.dll (file missing)
O2 - BHO: (no name) - {B392BAA0-359E-4522-A2F1-3F3B76E8BFC2} - C:\Program Files\InstallShield Installation Information\posecud83122.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm .exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager… - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://djpunkdx.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1136659656843
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/telepo…ty4LotTeleX.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5FF5410F-6BAE-473C-A8D8-2010B40C505B}: NameServer = 192.168.2.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: hgghefc - hgghefc.dll (file missing)
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
Seems your missing an importatnt part of your operating system. Let's get it reistalled in case you ever need it.
Nothing is going to change on your computer other than we are going to reinstall the recovery Console.


Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System:
YOURS IS WINDOWS XP SERVICE PACK 2

[external image: Posted Image]

Download the file & save it as it's originally named, to your desktop along with ComboFix.exe.


[external image: Posted Image]


Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.
Did NOT restart, as you said, here you go. CF-RC WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
I would just like to ask, i have this and a backup system, in case this happens, but in my career, any such incident is a slowdown, what would you recomend as a good virus solution, after this, i would not mind paying for it. As well, i read the article on WhatTheTech about the Uniblue RegistryBooster 2, and downloaded the trial, it found a lot of registry issues, could that be whats slowing down my system or would a good defrag do the trick ?
Your last log looks fine (CF-RC) Right now it's the infection you have slowing things down. This infection is a new breed of vundo. It has a file infector in it. So for now do not install any programs until we are all clean. Their files may get infected also. We can clean most of them but once in a while a program will need to be reinstalled. I have to ask a question on something I found in your one of logs. It may be a while today before I get an answer. I will be back as soon as I can
From the time of this post i will be at work, untill about 5 hours from now (or less), i will try to provide you with anything you need after, thank you so much so far tho. Should i leave my computer on or is shutting off ok ?
:: AT WORK ::

I notice that in a lot of cases HJT has to have its file name changed to escape detection by some versions of the Trojan.Vundo virus, since i was and may still be infected with the Trojan.Vundo, should i have done so aswell ?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI