What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] warning: possible spyware infection

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm getting the pop-up ("warning: possible spyware infection…") right below the toolbar in IE How do I get rid of this? Thanks
Post #3
Logfile of HijackThis v1.99.1
Scan saved at 8:27:05 AM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TSSchBkpService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Sharp\Sharpdesk\IndexTray.exe
C:\Program Files\Sharp\Sharpdesk\SharpTray.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Sharp\SHARPD~1\Indexer.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\Program Files\Timeslips\TSTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\ActiveWords\AWMonitor.exe
C:\Program Files\ActiveWords\AWMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\ActiveWords\AWApps\L&T\AWLearnTrain.exe
C:\PROGRA~1\ACTIVE~1\nahuatl.exe
C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
C:\Program Files\ActiveWords\AWFeedback.exe
C:\Program Files\Wireless Sync\Client\Monitor.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Wireless Sync\Client\Monitor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SXG Advisor - {9093EDD5-AD2E-4EF0-AF45-540C3F34AFCC} - C:\WINDOWS\dpvtporrtf.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Explorer Breadcrumbs Helper Class - {DB5FC78C-0D12-448B-A0B0-DB0F0E6B67DB} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Explorer Breadcrumbs - {A3EB65EC-D9B4-4DC1-88AF-0C7A21EBE5F9} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O3 - Toolbar: The elfwgps - {03DA425A-7234-425C-95A6-FB8CFB7FFD8E} - C:\WINDOWS\elfwgps.dll (file missing)
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IndexTray] "C:\Program Files\Sharp\Sharpdesk\IndexTray.exe"
O4 - HKLM\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [TSTimer] "C:\Program Files\Timeslips\TSTimer.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: ActiveWords.lnk = C:\Program Files\ActiveWords\AWMonitor.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: SmartUI.lnk = ?
O4 - Global Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
O4 - Global Startup: Wireless Sync Client.lnk = C:\Program Files\Wireless Sync\Client\Monitor.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1133113820857
O16 - DPF: {8AA1AE9E-9FB0-41B3-8911-89A1068A7FD1} (Installer Class) - https://www35.wirelesssync.vzw.com/en/SyncInstall.cab
O16 - DPF: {DADE1C2F-5A48-445C-82B5-3A5F102E84DF} (LifePicsUploader.UserControl1) - http://shewmakers.lifepics.com/common/User…icsUploader.CAB
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\Software\..\Telephony: DomainName = SMMC.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMMCLAW.COM
O17 - HKLM\System\CS1\Services\Tcpip\..\{35C8060A-4578-4AE5-95BF-0C5DC9C0F4CF}: NameServer = 192.168.1.2
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = SMMC.local
O18 - Protocol: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: aswmklt - {37C8D197-4226-429D-AA0A-1F00DF2A52EB} - C:\WINDOWS\aswmklt.dll
O21 - SSODL: bqxomdo - {E41B92A4-C81D-4051-A2E6-EC2215C05AEC} - C:\WINDOWS\bqxomdo.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Card Adapter (NETDown) - Unknown owner - C:\WINDOWS\smss.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TimeslipsBackup (TSScheduleBackup) - Unknown owner - C:\WINDOWS\system32\TSSchBkpService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Post #4
A. Viewpoint Manager is considered foistware which means a program that is most often installed without the user's consent. If you did not agree to it being installed and want to rid your system of it, please UNINSTALL it through Add/Remove programs then DELETE the following folder and all its content: C:\Program Files\Viewpoint Manager.


B. Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Regards,

Trevuren
Post #5
SDFix: Version 1.131

Run by [removed] on Thu 01/24/2008 at 11:05 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default HomePage Value
Restoring Default Desktop Components Value

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\aswmklt.dll - Deleted
C:\WINDOWS\dat.txt - Deleted
C:\WINDOWS\dpvtporrtf.dll - Deleted
C:\WINDOWS\fvqkfsp.exe - Deleted
C:\WINDOWS\rs.txt - Deleted
C:\WINDOWS\search_res.txt - Deleted





Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\explorer.exe
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 11:14:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Symantec\\pcAnywhere\\WINAW32.EXE"="C:\\Program Files\\Symantec\\pcAnywhere\\WINAW32.EXE:*:Enabled:pcAnywhere Main Program"
"C:\\Program Files\\Symantec\\pcAnywhere\\AWHOST32.EXE"="C:\\Program Files\\Symantec\\pcAnywhere\\AWHOST32.EXE:*:Enabled:pcAnywhere Host Service"
"C:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe"="C:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe:*:Enabled:pcAnywhere Remote Service"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Sharp\\Sharpdesk\\sdFTP.exe"="C:\\Program Files\\Sharp\\Sharpdesk\\sdFTP.exe:*:Enabled:sdFTP"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

Remaining Files:
—————

File Backups: - C:\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes:

Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT100.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT101.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT102.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT103.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT104.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT105.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT106.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT107.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT109.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT10A.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT10B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT10C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT10D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT10E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT10F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT11.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT110.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT111.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT112.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT113.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT115.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT116.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT117.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT119.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT11A.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT11B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT11F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT12.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT120.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT121.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT122.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT123.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT124.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT126.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT127.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT128.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT129.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT12A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT12B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT12D.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT12E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT12F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT13.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT130.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT131.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT132.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT133.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT134.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT135.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT136.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT137.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT138.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT139.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT13A.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT13B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT13C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT13D.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT13E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT13F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT14.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT140.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT141.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT142.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT143.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT144.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT145.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT146.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT147.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT148.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT149.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT14A.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT14B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT14C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT14D.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT14E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT14F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT15.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT150.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT151.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT152.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT153.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT154.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT155.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT156.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT157.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT158.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT159.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT15A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT15B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT15C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT15D.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT15E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT15F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT16.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT160.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT161.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT162.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT163.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT164.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT165.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT166.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT167.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT168.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT169.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT16A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT16B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT16C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT16D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT16E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT16F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT17.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT170.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT171.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT172.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT173.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT174.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT175.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT176.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT177.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT178.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT179.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT17A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT17B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT17C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT17D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT17E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT17F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT18.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT180.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT181.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT182.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT183.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT184.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT185.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT186.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT187.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT188.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT189.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT18A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT18B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT18C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT18D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT18E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT18F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT19.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT190.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT191.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT192.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT193.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT194.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT195.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT196.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT197.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT198.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT199.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT19A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT19B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT19C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT19D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT19E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT19F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A0.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A2.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A3.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A4.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A5.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A6.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A7.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A8.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1A9.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1AA.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1AB.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1AC.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1AD.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1AE.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1AF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B0.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B2.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B3.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B4.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B5.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B6.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B7.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B8.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1B9.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1BA.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1BB.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1BC.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1BD.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1BE.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1BF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1C0.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1C1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1C2.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1C3.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1C4.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1C5.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1CF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1D0.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1D2.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1D8.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1D9.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1DA.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1DB.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1DC.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1E2.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1E4.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1E5.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1E6.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1E7.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1E8.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1EA.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1EB.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1EF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1F0.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1F4.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1F5.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1F7.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1F8.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1FC.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1FD.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT1FE.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT20.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT200.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT201.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT202.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT203.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT204.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT209.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT20B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT20C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT20D.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT21.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT211.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT212.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT213.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT215.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT219.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT21A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT21B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT21C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT21E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT21F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT22.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT220.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT221.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT222.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT223.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT225.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT226.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT227.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT228.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT229.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT22A.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT22C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT22D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT22E.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT22F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT23.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT230.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT232.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT233.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT234.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT235.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT236.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT238.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT239.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT23A.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT23B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT23C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT23E.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT23F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT24.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT240.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT241.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT242.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT243.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT245.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT246.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT247.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT248.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT249.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT24B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT24C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT24D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT24E.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT24F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT25.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT250.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT252.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT253.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT254.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT255.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT256.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT258.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT259.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT25A.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT25B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT25C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT25D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT25F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT26.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT260.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT261.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT262.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT263.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT265.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT266.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT267.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT268.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT269.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT26B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT26C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT26D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT26E.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT26F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT27.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT270.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT272.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT273.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT274.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT275.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT276.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT277.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT279.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT27A.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT27B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT27C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT27D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT27F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT28.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT280.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT281.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT282.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT283.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT285.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT286.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT287.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT288.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT289.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT28B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT28C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT28D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT28E.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT28F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT29.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT290.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT291.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT293.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT296.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT29D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT29E.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT29F.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2A1.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2A2.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2A7.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2A8.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2A9.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2AA.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2AC.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2AD.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2AE.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2AF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B0.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B2.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B3.tmp"
Thu 24 Jan 2008 85,946 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B5.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B6.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B7.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2B8.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2BD.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2BE.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2BF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2C.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2C0.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2C1.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2C2.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2C7.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2C9.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2D.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT2F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT30.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT31.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT32.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT33.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT34.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT36.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT38.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT39.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT3A.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT3B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT3C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT3D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT3E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT42.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT43.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT44.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT45.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT46.tmp"
Mon 21 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT47.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT48.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT49.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT4A.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT4B.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT4C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT4D.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT4E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT4F.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT5.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT50.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT51.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT52.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT53.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT56.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT57.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT58.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT59.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT5A.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT5B.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT5C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT5D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT5E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT60.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT61.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT62.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT63.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT64.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT65.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT66.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT67.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT68.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT69.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT6A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT6C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT6D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT6E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT6F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT70.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT71.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT72.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT74.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT75.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT76.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT77.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT78.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT79.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT7A.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT7E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT7F.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT80.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT82.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT83.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT84.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT85.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT86.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT87.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT88.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT8A.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT8B.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT8C.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT8D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT8E.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT8F.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT91.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT93.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT94.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT95.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT97.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT98.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT99.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT9C.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT9D.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT9E.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BIT9F.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA1.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA2.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA3.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA4.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA5.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA6.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA7.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITA9.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITAA.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITAB.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITAC.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITAD.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITAE.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITAF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB2.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB3.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB4.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB5.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB6.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB7.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITB8.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITBA.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITBB.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITBC.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITBD.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITBE.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITBF.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC0.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC1.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC2.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC3.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC4.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC6.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC7.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC8.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITC9.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITCA.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITCC.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITCD.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITCE.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITCF.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD0.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD3.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD5.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD6.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD7.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD8.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITD9.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITDC.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITDD.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITDE.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITDF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE0.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE3.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE4.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE5.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE6.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE7.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE8.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITE9.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITEA.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITEB.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITED.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITEE.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITEF.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF0.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF1.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF2.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF3.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF5.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF6.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF7.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF8.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITF9.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITFA.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITFB.tmp"
Tue 22 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITFD.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITFE.tmp"
Thu 24 Jan 2008 0 A..H. — "C:\Documents and Settings\David.McDermott\Local Settings\Temp\BITFF.tmp"
Wed 23 Jan 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT42.tmp"
Mon 30 Jul 2001 44,544 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\SCHOOL\~WRL0003.tmp"
Tue 13 Aug 2002 33,280 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\SMMC\~WRL1306.tmp"
Fri 3 May 2002 51,712 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL0533.tmp"
Fri 3 May 2002 53,248 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL0546.tmp"
Fri 3 May 2002 28,672 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL0893.tmp"
Fri 3 May 2002 36,352 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL0929.tmp"
Fri 3 May 2002 34,304 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1004.tmp"
Fri 3 May 2002 57,856 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1102.tmp"
Fri 3 May 2002 24,064 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1239.tmp"
Fri 3 May 2002 34,304 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1610.tmp"
Fri 3 May 2002 26,624 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1647.tmp"
Fri 3 May 2002 35,328 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1714.tmp"
Fri 3 May 2002 26,624 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1756.tmp"
Fri 3 May 2002 41,984 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1802.tmp"
Fri 3 May 2002 56,320 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1810.tmp"
Fri 3 May 2002 25,600 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1864.tmp"
Fri 3 May 2002 59,392 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1881.tmp"
Fri 3 May 2002 47,616 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL1993.tmp"
Fri 3 May 2002 44,032 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL2136.tmp"
Fri 3 May 2002 25,088 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL2248.tmp"
Fri 3 May 2002 41,984 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL2266.tmp"
Fri 3 May 2002 49,664 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL2737.tmp"
Fri 3 May 2002 31,232 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL2762.tmp"
Fri 3 May 2002 26,112 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL2903.tmp"
Fri 3 May 2002 61,952 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL3033.tmp"
Fri 3 May 2002 27,136 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL3458.tmp"
Fri 3 May 2002 38,400 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL3776.tmp"
Fri 3 May 2002 44,032 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL3803.tmp"
Fri 3 May 2002 37,376 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\TEUTSCH\~WRL3865.tmp"
Mon 25 Jan 1999 57,344 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\Wills and Estates\~WRL1762.TMP"
Fri 26 Oct 2001 55,296 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\ZIELINSK\~WRL1777.tmp"
Tue 1 Jun 2004 117,248 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\SIERRA\Commercial Brokerage\~WRL0486.tmp"
Mon 7 May 2001 60,469 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\VANTAGE\RMBG2\PFT1295.TMP"
Mon 8 Apr 2002 50,176 A..H. — "C:\Documents and Settings\David.McDermott\My Documents\S-Z\Wills and Estates\ALEXAND\~WRL0159.tmp"
Mon 20 Jun 2005 8 A..H. — "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"
Mon 20 Jun 2005 8 A..H. — "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp"
Fri 24 Jun 2005 8 A..H. — "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\lock.tmp"
Fri 24 Jun 2005 8 A..H. — "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4\lock.tmp"

Finished!


Logfile of HijackThis v1.99.1
Scan saved at 11:26:12 AM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TSSchBkpService.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Sharp\Sharpdesk\IndexTray.exe
C:\Program Files\Sharp\Sharpdesk\SharpTray.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Sharp\SHARPD~1\Indexer.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\Program Files\Timeslips\TSTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\ActiveWords\AWMonitor.exe
C:\Program Files\ActiveWords\AWMonitor.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\PROGRA~1\ACTIVE~1\nahuatl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ActiveWords\AWFeedback.exe
C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
C:\Program Files\Wireless Sync\Client\Monitor.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Wireless Sync\Client\Monitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Explorer Breadcrumbs Helper Class - {DB5FC78C-0D12-448B-A0B0-DB0F0E6B67DB} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Explorer Breadcrumbs - {A3EB65EC-D9B4-4DC1-88AF-0C7A21EBE5F9} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IndexTray] "C:\Program Files\Sharp\Sharpdesk\IndexTray.exe"
O4 - HKLM\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [TSTimer] "C:\Program Files\Timeslips\TSTimer.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: ActiveWords.lnk = C:\Program Files\ActiveWords\AWMonitor.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: SmartUI.lnk = ?
O4 - Global Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
O4 - Global Startup: Wireless Sync Client.lnk = C:\Program Files\Wireless Sync\Client\Monitor.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1133113820857
O16 - DPF: {8AA1AE9E-9FB0-41B3-8911-89A1068A7FD1} (Installer Class) - https://www35.wirelesssync.vzw.com/en/SyncInstall.cab
O16 - DPF: {DADE1C2F-5A48-445C-82B5-3A5F102E84DF} (LifePicsUploader.UserControl1) - http://shewmakers.lifepics.com/common/User…icsUploader.CAB
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\Software\..\Telephony: DomainName = SMMC.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMMCLAW.COM
O17 - HKLM\System\CS1\Services\Tcpip\..\{35C8060A-4578-4AE5-95BF-0C5DC9C0F4CF}: NameServer = 192.168.1.2
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = SMMC.local
O18 - Protocol: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Card Adapter (NETDown) - Unknown owner - C:\WINDOWS\smss.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TimeslipsBackup (TSScheduleBackup) - Unknown owner - C:\WINDOWS\system32\TSSchBkpService.exe
Post #6
It is looking much better but I believe there are still items to work on.


Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

——————————————————————–

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

——————————————————————–

Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
Post #7
I can't get ComboFix to work - it gets through about 10 steps and then disappears and I'm looking at the desktop. This after about 30 minutes. What should I do now??
Post #8 last edited
Run it again then write down the exact wording of the last successful step as well as any error messages that may follow. A screen shot would be nice if you are able. Trevuren
Post #9
I did - I ran it twice (w/ reboot in between) before I posted the last reply. No messages - one minute you see the blue screen w/ the steps and then nothing, you're back to desktop. However, w/o a re-boot I have no internet. I think the last step I saw it get to was step 10 Help!
Post #10
I am off to check with the developer of this great tool who should help us pinpoint the problem. It could take a while to get our answer. Don't be surprised if you see a few people looking in on the topic. Trevuren
Post #11
Back already. The answer is:

CF is designed to skip troubled stages. It shouldn't just prematurely end.

Please have him download a fresh copy. When he runs it, please have him note the exact stage where it hiccups, if it hiccups



1. First, we UNINSTALL your present copy.

Click START then RUN
  • Now type Combofix /u in the runbox and click OK


  • [external image: Posted Image]


2. Next, please download ComboFix by sUBs from HERE or HERE
  • You must download it to and run it from your Desktop
  • First, physically disconnect your computer from the internet.
  • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
  • Re-enable all the programs that were disabled during the running of ComboFix.
  • Now you may reconnect your machine to the internet and post the logs

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
Post #12
Thanks - uninstall/re-install worked.
Here's the ComboFix Log:

ComboFix 08-01-23.1C - David.McDermott 2008-01-25 8:08:16.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.100 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-25 08:07 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-24 11:04 . 2008-01-24 11:04 d——– C:\WINDOWS\ERUNT
2008-01-22 14:51 . 2008-01-24 11:31 d——– C:\Program Files\SUPERAntiSpyware
2007-12-27 10:54 . 2007-12-27 10:54 d——– C:\Program Files\Minimalist

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 15:05 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-01-25 14:13 ——— d—–w C:\Program Files\LogMeIn
2008-01-24 21:51 ——— d—–w C:\Program Files\ActiveWords
2008-01-24 18:30 ——— d—–w C:\Program Files\Yahoo!
2008-01-24 18:29 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-24 18:29 ——— d—–w C:\Program Files\Common Files\Pumatech Shared
2007-11-22 14:13 87,352 —-a-w C:\WINDOWS\SYSTEM32\LMIinit.dll
2007-11-22 14:13 83,288 —-a-w C:\WINDOWS\SYSTEM32\LMIRfsClientNP.dll
2007-11-22 14:13 23,736 —-a-w C:\WINDOWS\SYSTEM32\lmimirr.dll
2007-11-22 14:13 21,496 —-a-w C:\WINDOWS\SYSTEM32\LMIport.dll
2007-11-22 14:13 10,040 —-a-w C:\WINDOWS\SYSTEM32\lmimirr2.dll
2007-11-14 07:26 450,560 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\jscript.dll
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
2007-11-07 09:26 721,920 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\lsasrv.dll
2007-10-30 17:20 360,064 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2007-10-30 09:55 3,065,856 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-10-28 00:40 227,328 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-28 00:40 227,328 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wmasf.dll
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2004-12-08 15:50 67160]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"H/PC Connection Agent"="C:\PROGRA~1\MI3AA1~1\wcescomm.exe" [2006-06-20 21:36 1207080]
"TSTimer"="C:\Program Files\Timeslips\TSTimer.exe" [2006-06-15 17:28 2429992]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-07 02:24 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 10:16 135168]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 10:52 339968]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184]
"IndexTray"="C:\Program Files\Sharp\Sharpdesk\IndexTray.exe" [2003-01-22 10:43 106496]
"SharpTray"="C:\Program Files\Sharp\Sharpdesk\SharpTray.exe" [2003-01-22 10:52 28672]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 03:00 143360]
"PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [2002-08-12 09:33 45108]
"IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [2002-08-12 10:07 36864]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-10-18 13:26 180269]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-05-15 13:02 1831936]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 12:02 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-03-17 05:34 124656]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 19:52 483328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-17 13:03 63048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42 267064]

C:\Documents and Settings\maintenance\Start Menu\Programs\Startup\
Backup.lnk - C:\WINDOWS\SYSTEM32\NTBACKUP.EXE [2004-08-04 03:00:00 1200128]
Disk Cleanup.lnk - C:\WINDOWS\SYSTEM32\CLEANMGR.EXE [2004-08-04 03:00:00 64000]
Disk Defragmenter.lnk - C:\WINDOWS\SYSTEM32\DEFRAG.EXE [2004-08-04 03:00:00 25088]
Microsoft Office Downloads Home Page.url [2004-07-26 19:20:12 267]
Microsoft Windows Update.url [2004-09-25 19:04:15 457]
ScanDisk.lnk - C:\WINDOWS\SYSTEM32\CHKDSK.EXE [2004-08-04 03:00:00 11776]

C:\Documents and Settings\David.McDermott\Start Menu\Programs\Startup\
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2005-06-26 15:54:53 45056]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ActiveWords.lnk - C:\Program Files\ActiveWords\AWMonitor.exe [2004-06-22 14:43:07 1269760]
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe [2006-11-14 11:23:44 25214]
SmartUI.lnk - C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe [2002-08-12 09:00:40 1568768]
Start Network Scanner Tool.lnk - C:\Program Files\Sharp\Sharpdesk\sdFTP.exe [2003-01-08 10:07:46 347648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-11-22 07:13 87352 C:\WINDOWS\SYSTEM32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
PCANotify.dll 2002-02-15 09:51 24638 C:\WINDOWS\SYSTEM32\PCANotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 03:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
–a—— 2004-07-19 05:51 306688 C:\Program Files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
–a—— 2004-12-05 23:05 127035 C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
–a—— 2005-01-26 23:02 86016 C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-02-23 14:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2004-07-27 14:50 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 09:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
–a—— 2004-10-14 12:42 1404928 C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2003-11-19 15:48 32881 C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-04-05 10:55]
R2 TSScheduleBackup;TimeslipsBackup;C:\WINDOWS\system32\TSSchBkpService.exe [2006-06-15 17:17]
R3 brfilt;Brother MFC Filter Driver;C:\WINDOWS\system32\Drivers\Brfilt.sys [2001-08-17 12:12]
R3 brparimg;Brother Multi Function Parallel Image driver;C:\WINDOWS\system32\DRIVERS\BrParImg.sys [2001-08-17 12:12]
R3 BrParWdm;Brother WDM Parallel Driver;C:\WINDOWS\system32\Drivers\BrParwdm.sys [2001-08-17 12:12]
S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-04-17 13:00]
S3 OnePointDomainAdminService;Active Directory Migration Agent;"C:\Program Files\OnePointDomainAgent\DCTAgentService.exe" [2005-03-24 18:39]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 08:12:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-25 8:14:11
.
2008-01-09 10:02:42 — E O F —



Here's the new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 08:19, on 2008-01-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TSSchBkpService.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Sharp\Sharpdesk\IndexTray.exe
C:\Program Files\Sharp\Sharpdesk\SharpTray.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\PROGRA~1\Sharp\SHARPD~1\Indexer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\DOCUME~1\DAVID~1.MCD\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOCUME~1\DAVID~1.MCD\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Explorer Breadcrumbs Helper Class - {DB5FC78C-0D12-448B-A0B0-DB0F0E6B67DB} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Explorer Breadcrumbs - {A3EB65EC-D9B4-4DC1-88AF-0C7A21EBE5F9} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IndexTray] "C:\Program Files\Sharp\Sharpdesk\IndexTray.exe"
O4 - HKLM\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [TSTimer] "C:\Program Files\Timeslips\TSTimer.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: ActiveWords.lnk = C:\Program Files\ActiveWords\AWMonitor.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SmartUI.lnk = ?
O4 - Global Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1133113820857
O16 - DPF: {8AA1AE9E-9FB0-41B3-8911-89A1068A7FD1} (Installer Class) - https://www35.wirelesssync.vzw.com/en/SyncInstall.cab
O16 - DPF: {DADE1C2F-5A48-445C-82B5-3A5F102E84DF} (LifePicsUploader.UserControl1) - http://shewmakers.lifepics.com/common/User…icsUploader.CAB
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\Software\..\Telephony: DomainName = SMMC.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMMCLAW.COM
O17 - HKLM\System\CS1\Services\Tcpip\..\{35C8060A-4578-4AE5-95BF-0C5DC9C0F4CF}: NameServer = 192.168.1.2
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = SMMC.local
O18 - Protocol: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TimeslipsBackup (TSScheduleBackup) - Unknown owner - C:\WINDOWS\system32\TSSchBkpService.exe
Post #13
I am glad that it worked. Good news.

A. Please RUN HijackThis
  • Click the SCAN button to produce a log.

  • Place a check mark beside each one of the following items:

    R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)

  • Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

  • Now please run HJT again and post the new log in your next reply.



B. I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #14
# version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=2823 (20080125) # vers_arch_module=1.063 (20080117) # vers_adv_heur_module=1.060 (20070601) # EOSSerial=f65200f39121aa4b99a9643a651d9071 # end=finished # remove_checked=false # unwanted_checked=false # utc_time=2008-01-25 07:56:06 # local_time=2008-01-25 12:56:06 (-0700, Mountain Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 2 # scanned=360114 # found=3 # scan_time=3241 C:\Program Files\AIM\Sysfiles\WxBug.EXE Win32/Adware.WBug.A application E0D92AC5FDD264E4ED40D45C75934F1B C:\Program Files\AIM\Sysfiles\WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000 C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll Win32/Adware.WBug.A application 5CB0279BC8B35D99E79764293D279C85
Post #15
Sorry, I forgot to post the last HijackThis log
Here it is:

Logfile of HijackThis v1.99.1
Scan saved at 13:38, on 2008-01-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TSSchBkpService.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Sharp\Sharpdesk\IndexTray.exe
C:\Program Files\Sharp\Sharpdesk\SharpTray.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Sharp\SHARPD~1\Indexer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Explorer Breadcrumbs Helper Class - {DB5FC78C-0D12-448B-A0B0-DB0F0E6B67DB} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Explorer Breadcrumbs - {A3EB65EC-D9B4-4DC1-88AF-0C7A21EBE5F9} - C:\Program Files\Minimalist\Explorer Breadcrumbs\BCToolbar.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IndexTray] "C:\Program Files\Sharp\Sharpdesk\IndexTray.exe"
O4 - HKLM\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [TSTimer] "C:\Program Files\Timeslips\TSTimer.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: ActiveWords.lnk = C:\Program Files\ActiveWords\AWMonitor.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: SmartUI.lnk = ?
O4 - Global Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1133113820857
O16 - DPF: {8AA1AE9E-9FB0-41B3-8911-89A1068A7FD1} (Installer Class) - https://www35.wirelesssync.vzw.com/en/SyncInstall.cab
O16 - DPF: {DADE1C2F-5A48-445C-82B5-3A5F102E84DF} (LifePicsUploader.UserControl1) - http://shewmakers.lifepics.com/common/User…icsUploader.CAB
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\Software\..\Telephony: DomainName = SMMC.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = SMMCLAW.COM
O17 - HKLM\System\CS1\Services\Tcpip\..\{35C8060A-4578-4AE5-95BF-0C5DC9C0F4CF}: NameServer = 192.168.1.2
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = SMMC.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = SMMC.local
O18 - Protocol: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TimeslipsBackup (TSScheduleBackup) - Unknown owner - C:\WINDOWS\system32\TSSchBkpService.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI