Spyware / Malware / Virus Removal

[Resolved] Help Removing AV System Care

7 min read

Looking for the outcome? Ask AI

Jason2001F350 Topic Starter

Post #1February 6, 2008, 6:57 PM UTC last edited February 6, 2008, 9:50 PM UTC

I have this bothering virus, and need help removing it. I will post my HijackThis Log after this message. Would greatly appreciate any help. Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:58:35 PM, on 2/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe
C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - d:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Zango /fleok=1D8A83A5C4EC167A90A86C2A1FBB39BFE4976E26CAEDA120180A196D6093 - {E1BACF55-35E1-4E47-9247-2D48660E5545} - C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O3 - Toolbar: Zango - {E1BACF55-35E1-4E47-9247-2D48660E5545} - C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe
O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe"
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-21-1409082233-115176313-725345543-1005\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Valerie')
O4 - HKUS\S-1-5-21-1409082233-115176313-725345543-1005\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Valerie')
O4 - HKUS\S-1-5-21-1409082233-115176313-725345543-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Valerie')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Valerie')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 Startup: PowerReg Scheduler V3.exe (User 'Valerie')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 User Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Valerie')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 User Startup: PowerReg Scheduler V3.exe (User 'Valerie')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire…loadControl.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe

–
End of file - 6991 bytes

Jason2001F350

Post #2February 11, 2008, 7:24 PM UTC

Please, can someone help me get rid AV System Care. Thanks, Jason

LDTate

Post #3February 11, 2008, 10:29 PM UTC

I don't see a anti-virus program running. Get this free one.

Click HERE Click the Download Now and Save, Install, Update and run a full scan.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment

Jason2001F350

Post #4February 12, 2008, 7:39 PM UTC

I am not able to acess my control panel. It has completely vanished. Had an annoying pop up that kept prompting me to buy AV System Care but windows did an update and removed it. I installed the anti-virus program and did a full scan, Here is my new log. Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:28:33 PM, on 2/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe
C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - d:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Zango /fleok=1D8A83A5C4EC167A90A86C2A1FBB39BFE4976E26CAEDA120180A196D6093 - {E1BACF55-35E1-4E47-9247-2D48660E5545} - C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O3 - Toolbar: Zango - {E1BACF55-35E1-4E47-9247-2D48660E5545} - C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe
O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire…loadControl.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe

–
End of file - 6908 bytes

LDTate

Post #5February 12, 2008, 9:31 PM UTC

Download this tool to a place where you'll find it easily:

http://djlizard.net/Dial-a-fix-2006-09-19.exe

Doubleclick Dial-a-fix-2006-09-19.exe to start the program.
Immediately a window will open with on top: "Dial-A-fix : Restrictive policies"
You'll see registry keys.
Check them all and click the remove button below.
Then click close. This should close the policies window.
Then click exit in the main window under it, because we don't need anything from there.

REBOOT your computer afterwards, important.

now see if the control panel will work

Jason2001F350

Post #6February 13, 2008, 2:54 AM UTC

ok, I did it but have one problem. I don't even have a control panel icon anymore, so I don't know how to access it. If I try and use the set program access and defaults one (as an example) I get this message: "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator. " It also gave this message when the control panel was here and I tried to do anything inside the panel. Also thanks for your help with this, I really really do appreciate it.

LDTate

Post #7February 13, 2008, 2:55 AM UTC

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Jason2001F350

Post #8February 13, 2008, 3:34 AM UTC

Combo fix log and hijackthis log. ComboFix 08-02-13.2 - Jason 2008-02-12 21:24:55.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.673 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jason\Application Data\ShoppingReport
C:\Documents and Settings\Jason\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Jason\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Jason\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Jason\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Jason\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Jason\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Jason\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
C:\Documents and Settings\Jason\Application Data\ultra
C:\Documents and Settings\Jason\Application Data\ultra\uninstall.bat
C:\Documents and Settings\Lewis\Application Data\ShoppingReport
C:\Documents and Settings\Lewis\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Lewis\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Lewis\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Lewis\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Lewis\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Lewis\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Lewis\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
C:\Documents and Settings\Valerie\Application Data\ShoppingReport
C:\Documents and Settings\Valerie\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Valerie\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Valerie\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Valerie\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Valerie\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Valerie\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Valerie\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
C:\Documents and Settings\Valerie\Application Data\ultra
C:\Documents and Settings\Valerie\Application Data\ultra\uninstall.bat
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
C:\Program Files\ShoppingReport\Uninst.exe
C:\Program Files\Ultimate Defender
C:\WINDOWS\inf\ultra.inf
C:\WINDOWS\windsk.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))
.

2008-02-12 21:20 . 2006-02-28 06:00 388,608 –a—— C:\kmd.exe
2008-02-12 15:34 . 2008-02-12 15:34 d——– C:\Documents and Settings\Lewis\Application Data\AVG7
2008-02-12 10:35 . 2008-02-12 10:35 d——– C:\Documents and Settings\Valerie\Application Data\AVG7
2008-02-11 22:44 . 2008-02-12 12:15 d——– C:\Documents and Settings\Jason\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2008-02-11 22:42 . 2008-02-11 22:42 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-02-11 22:41 . 2008-02-11 22:41 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-11 22:41 . 2008-02-12 12:12 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-02-09 18:17 . 2008-02-09 18:17 d——– C:\Program Files\iWin.com Games
2008-02-09 16:50 . 2005-11-08 15:38 57,344 –a—— C:\WINDOWS\system32\Big Kahuna Words.scr
2008-02-07 10:22 . 2008-02-07 10:22 d——– C:\Documents and Settings\Valerie\Application Data\Zango
2008-02-06 20:45 . 2008-02-06 20:45 d——– C:\Documents and Settings\Jason\Application Data\Zango
2008-02-06 14:59 . 2008-02-06 14:59 d——– C:\Documents and Settings\Lewis\Application Data\Zango
2008-02-06 12:42 . 2008-02-06 12:42 d——– C:\Program Files\Trend Micro
2008-02-06 12:22 . 2008-02-06 12:22 d——– C:\Program Files\Zango
2008-02-06 12:22 . 2008-02-06 12:22 d——– C:\Documents and Settings\Jason\Application Data\WeatherDPA
2008-02-06 12:22 . 2008-02-12 20:44 d——– C:\Documents and Settings\All Users\Application Data\ZangoSA
2008-02-06 12:22 . 2008-02-06 12:22 d——– C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2008-01-19 17:04 . 2008-01-19 17:04 d——– C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-13 02:42 ——— d—–w C:\Program Files\lx_cats
2008-02-11 21:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-09 00:10 ——— d—–w C:\Documents and Settings\Jason\Application Data\LimeWire
2008-02-02 07:03 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-02 07:03 ——— d—–w C:\Program Files\iWin.com
2008-01-05 07:37 ——— d—–w C:\Program Files\Enigma Software Group
2007-12-30 20:05 ——— d—–w C:\Program Files\Common Files\DirectX
2007-12-30 20:04 ——— d—–w C:\Program Files\Common Files\Adobe
2007-12-30 20:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\InterTrust
2007-12-30 19:53 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-29 19:25 ——— d—–w C:\Documents and Settings\Valerie\Application Data\egamestoolbar
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\PlayFirst
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Magic Academy
2007-12-23 00:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Escape From Paradise
2007-12-22 21:03 ——— d—–w C:\Documents and Settings\Valerie\Application Data\iWin
2007-12-22 18:17 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-21 05:11 81,920 —-a-w C:\WINDOWS\system32\IEDFix.exe
2007-12-20 19:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\InterAction studios
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Flood Light Games
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Flood Light Games
2007-12-15 04:56 ——— d—–w C:\Documents and Settings\Valerie\Application Data\iWinArcade
2007-12-15 04:56 ——— d—–w C:\Documents and Settings\All Users\Application Data\iWin Games
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}]
2007-05-24 12:35 1897472 –a—— C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]
2007-01-31 03:58 78848 –a—— d:\PROGRA~1\IWINGA~1\IWINGA~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1BACF55-35E1-4E47-9247-2D48660E5545}]
2007-12-13 13:54 546056 –a—— C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{1017A80C-6F09-4548-A84D-EDD6AC9525F0}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}
{E1BACF55-35E1-4E47-9247-2D48660E5545}

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CLASSES_ROOT\clsid\{e1bacf55-35e1-4e47-9247-2d48660e5545}]
[HKEY_CLASSES_ROOT\HostIE.Bho.1]
[HKEY_CLASSES_ROOT\TypeLib\{087C4054-0A2B-4F35-B0DB-BED3E21650F4}]
[HKEY_CLASSES_ROOT\HostIE.Bho]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}"= C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL [2007-05-24 12:35 1897472]
"{E1BACF55-35E1-4E47-9247-2D48660E5545}"= C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll [2007-12-13 13:54 546056]

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CLASSES_ROOT\clsid\{e1bacf55-35e1-4e47-9247-2d48660e5545}]
[HKEY_CLASSES_ROOT\HostIE.Bho.1]
[HKEY_CLASSES_ROOT\TypeLib\{087C4054-0A2B-4F35-B0DB-BED3E21650F4}]
[HKEY_CLASSES_ROOT\HostIE.Bho]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="C:\Program Files\PDF\pdfSaver\pdfSaver3.exe" [2004-05-19 13:29 385024]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 14:39 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 12:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"pdfSaver3"="" []
"602PC SUITE PDF Saver"="C:\Program Files\Common Files\soft602\pdfSaver.exe" [2004-12-06 10:10 49152]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 11:45 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 23:10 98304]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 12:38 65536]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"LTMSG"="LTMSG.exe" [2003-07-14 09:52 40960 C:\WINDOWS\ltmsg.exe]
"SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [ ]
"ZangoOE"="C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe" [2007-12-13 13:53 91400]
"ZangoSA"="C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe" [2007-12-13 14:13 724232]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-12 12:12 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-11 22:41 219136]

C:\Documents and Settings\Valerie\Start Menu\Programs\Startup\
iWin Desktop Alerts.lnk - C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe [2007-12-14 22:56:42 58368]
PowerReg Scheduler V3.exe [2007-07-14 17:53:13 225280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-05-18 14:39:17 124912]

R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]
rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\CChat25.inf,PerUserRemove
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 21:26:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCRCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-12 21:26:54
ComboFix-quarantined-files.txt 2008-02-13 03:26:40
.
2008-01-09 18:34:33 — E O F — And Hijackthis Now: Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:06 PM, on 2/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe
C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - d:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Zango /fleok=1D8A83A5C4EC167A90A86C2A1FBB39BFE4976E26CAEDA120180A196D6093 - {E1BACF55-35E1-4E47-9247-2D48660E5545} - C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O3 - Toolbar: Zango - {E1BACF55-35E1-4E47-9247-2D48660E5545} - C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKLM\..\Run: [ZangoOE] C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe
O4 - HKLM\..\Run: [ZangoSA] "C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire…loadControl.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe

–
End of file - 6322 bytes

Jason2001F350

Post #9February 13, 2008, 3:59 AM UTC

The control panel is back and everything seems to be functioning right. I am no longer getting that message. Let me know if it looks fixed to you. Once again, Thanks for all this help.

LDTate

Post #10February 13, 2008, 1:04 PM UTC last edited February 13, 2008, 1:05 PM UTC

If your Spyhunter isn't the paid for version, I'd suggest uninstalling it.

Open notepad and copy/paste the text in the Codebox below into it:

File::
d:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
C:\WINDOWS\ALCXMNTR.EXE
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe 

Folder::
C:\Documents and Settings\Valerie\Application Data\Zango
C:\Documents and Settings\Jason\Application Data\Zango
C:\Documents and Settings\Lewis\Application Data\Zango
C:\Program Files\Zango
C:\Documents and Settings\All Users\Application Data\ZangoSA
C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
C:\Program Files\iWin.com
C:\Documents and Settings\Valerie\Application Data\iWinArcade
C:\Documents and Settings\All Users\Application Data\iWin Games

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1BACF55-35E1-4E47-9247-2D48660E5545}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{E1BACF55-35E1-4E47-9247-2D48660E5545}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
[-HKEY_CLASSES_ROOT\clsid\{e1bacf55-35e1-4e47-9247-2d48660e5545}]
[-HKEY_CLASSES_ROOT\HostIE.Bho.1]
[-HKEY_CLASSES_ROOT\HostIE.Bho]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{E1BACF55-35E1-4E47-9247-2D48660E5545}"=-
[-HKEY_CLASSES_ROOT\clsid\{e1bacf55-35e1-4e47-9247-2d48660e5545}]
[-HKEY_CLASSES_ROOT\HostIE.Bho.1]
[-HKEY_CLASSES_ROOT\HostIE.Bho]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcxMonitor"=-
"ZangoOE"=-
"ZangoSA"=-

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

Jason2001F350

Post #11February 13, 2008, 6:35 PM UTC

The computer seems to be behaving fine. It is running normal and everything seems to be working. Here is the new combofix log and hijackthis log. ComboFix 08-02-13.2 - Jason 2008-02-13 12:19:02.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.580 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
C:\WINDOWS\ALCXMNTR.EXE
d:\PROGRA~1\IWINGA~1\IWINGA~1.DLL
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
C:\Documents and Settings\All Users\Application Data\iWin Games
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_all.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_dl.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_next.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_prev.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\WebUpdater.exe
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17032607-0218-0880-3221-38080F0FF9IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17034504-0653-0693-5392-39570F0FF0IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17034604-0277-0309-5882-48853F0FF1IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17034800-0742-0045-0942-63700F0FF3IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17034805-0702-0689-0672-56530F0FF3IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17034808-0066-0316-4142-05430F0FF3IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035004-0406-0725-1281-14330F0FF6IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035107-0417-0085-7541-12040F0FF7IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035303-0361-0921-6251-43300F0FF9IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035506-0588-0019-9212-07570F0FF1IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035506-0594-0326-0942-15750F0FF1IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035600-0635-0406-9452-35840F0FF2IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035607-0867-0806-6662-28010F0FF2IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17035800-0871-0331-4342-74480F0FF4IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17234787-0955-0368-1033-51706F0FF2IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17235791-5243-0113-1643-02620F0FF4IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17235925-2592-0512-7702-53436F0FF9IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17332510-5721-0673-0522-63180F0FF2IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17332759-9606-0506-2142-69428F0FF8IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17332869-0904-0280-0593-41760F0FF0IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17333741-7419-0814-0092-18575F0FF8IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17333957-9522-0292-5803-19976F0FF1IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17334259-9737-0130-9162-58845F0FF5IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17334756-3145-0437-2463-16760F0FF0IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17334937-1295-0149-9043-73810F0FF0IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17335251-2516-0149-8232-54019F0FF6IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17335453-9479-0330-2602-60951F0FF8IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17335552-8540-0625-9232-91494F0FF9IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17335657-9868-0257-3383-97168F0FF0IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17335657-9868-0568-5273-55411F0FF0IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17335732-9547-0626-7812-85714F0FF9IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{17335755-2757-0626-3873-78861F0FF1IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\Data\{72330353-9045-0357-0032-008F4F0FF3IW}.dta
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1732507216730526318_TheDaVinciCode.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1732672188803223808_Big Kahuna Reef 2.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1732796065062146942_Game.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1732899042800594176_Game.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1733714198140091857_BelieveInSanta.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1733975222925801997_TheTreasuresofMontezuma.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734297371309165884_academy.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734546536935393957_BigCityAdventureSF.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734761454372461676_GHOST Hunters.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734779553681035170_Escape.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734807420450946370_The Magicians Handbook Cursed Valley.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734857026890675653_DreamDayHoneymoon.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734880663164140543_SecretsOfGreatArt.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1734972951499047381_Travelogue360.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735044067251281433_MysteryPI.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735174170857541204_Interpol.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735215161498235401_Emerald Tale.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735333619216254330_Hawaiian Explorer Pearl Harbor.exe.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735434793302606095_Pirateville.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735525406259239149_EscapingAtlantis.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735565880199210757_Hidden Relics.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735565943260941575_HrtEgypt.exe.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735606354069453584_AmazingAdventures.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735678678066662801_LuckyClover.exe.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735678682573389716_Aquitania.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735678685685275541_start.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735712431131640262_Christmasville.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735725476267818571_LocoXmas.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735757576263877886_endhouse.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735808713314347448_PollyPride.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_1735955925127705343_Nightmare_1_0_4.ifn.stdat
C:\Documents and Settings\All Users\Application Data\iWin Games\drm\drm_723033045357003008_FishTycoon.ifn.stdat
C:\Documents and Settings\All Users\Application Data\ZangoSA
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA.dat
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAau.dat
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAEULA.mht
C:\Documents and Settings\Jason\Application Data\Zango
C:\Documents and Settings\Jason\Application Data\Zango\eskin\empty_bg_st.htm
C:\Documents and Settings\Jason\Application Data\Zango\eskin\FileManager.txt
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\1.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\1065003.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\1235615.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\221540.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\2883915.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\3251993.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\3893245.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\3893642.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\501546.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\600583.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\819382.sdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\domains.txt
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\13562
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\17025
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\17040
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\198449
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20128
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\202699
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25466
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26224
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\27503
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\281075
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33233
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34123
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34381
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\370167
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42425
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\427075
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44458
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449626
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\46021
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\471072
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\481176
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50939
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\50973
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52335
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54473
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\568061
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6292
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64434
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64446
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64495
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6616
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67469
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6873
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\731360
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737665
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738022
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744260
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744758
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753300
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753335
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753346
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\78245
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90819
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\90835
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93934
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95159
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95615
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\dynamic\ustat\3662.dat
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\btntrans.idx
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\btntrans1.dat
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\buttondir.txt
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\components.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\cursors.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_1000.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_2000.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_3000.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bar.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bbar1.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_logos.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_other.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\d_icons_weather.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\default.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_511745-514279.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_categorize.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_comparison.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-Mails.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-people.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_favorites.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_Games.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_Hide.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_hotbarcom.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_Hotmail.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_hsskin.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_jemster.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_jemsterie.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_jemsteruk.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_jobsearch.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_Mails.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_MobileSidewalk.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_new.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_premium.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_reun.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_ringtones.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_searchfor.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_searchgo.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_weather.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Default_yellowpages.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\editblbuttons.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\email-t1-bg.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\icons2.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\ie_games_icon.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\ie_video.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\keywords.idx
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\keywords1.dat
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\layout.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\linkpathlegal.txt
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\progress.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\s_icons_buttons.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\sales_buttons.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\sdfmodifier.xml
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\t2_bg.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\theweb.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\top7.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\Top7_theweb.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\tsd_bg.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\zango_btn.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\1\zango_ie_menu.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\btntrans.idx
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\btntrans1.dat
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\buttondir.txt
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\components.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\cursors.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_1000.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_2000.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_3000.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bar.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bbar1.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_logos.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_other.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\d_icons_weather.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\default.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_511745-514279.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_categorize.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_comparison.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-Mails.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-people.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_favorites.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_Games.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_Hide.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_hotbarcom.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_Hotmail.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_hsskin.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_jemster.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_jemsterie.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_jemsteruk.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_jobsearch.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_Mails.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_MobileSidewalk.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_new.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_premium.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_reun.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_ringtones.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_searchfor.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_searchgo.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_weather.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Default_yellowpages.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\editblbuttons.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-548964.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-9595.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\email-t1-bg.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\icons2.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\ie_games_icon.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\ie_video.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\keywords.idx
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\keywords1.dat
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\layout.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\linkpathlegal.txt
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\progress.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\s_icons_buttons.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\sales_buttons.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\sdfmodifier.xml
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\t2_bg.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\theweb.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\top7.cdf
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\Top7_theweb.mnu
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\tsd_bg.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\zango_btn.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\2\zango_ie_menu.res
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\buttondir.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\cursors.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_weather.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\default.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\editblbuttons.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\icons2.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_games_icon.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_video.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords1.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\layout.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\progress.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\sdfmodifier.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\t2_bg.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\top7.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\tsd_bg.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_btn.xip
C:\Documents and Settings\Jason\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_ie_menu.xip
C:\Documents and Settings\Lewis\Application Data\Zango
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\1.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\1383771.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\1788281.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\31633.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\3251993.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\3893245.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\600583.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\805478.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\819382.sdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\domains.txt
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\11213
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1491
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\17040
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\25818
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26213
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26656
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26664
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\27503
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\281075
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\290893
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32137
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32148
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33697
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34123
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34237
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\36598
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\378205
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40256
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\427075
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43486
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44878
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449626
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\47371
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\481176
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\482360
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52335
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\526389
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\531510
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\551747
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\578150
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59872
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6292
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64446
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64451
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\673444
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67469
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69263
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69911
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7198
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737950
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738022
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744260
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745021
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745201
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745304
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745356
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748176
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\752900
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753300
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753335
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753346
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\78592
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79246
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82292
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\82638
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\85547
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86379
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86587
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89462
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95615
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97498
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\dynamic\ustat\3661.dat
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\btntrans.idx
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\btntrans1.dat
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\buttondir.txt
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\components.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\cursors.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_1000.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_2000.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_3000.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bar.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bbar1.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_logos.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_other.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\d_icons_weather.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\default.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_511745-514279.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_categorize.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_comparison.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-Mails.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-people.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_favorites.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_Games.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_Hide.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_hotbarcom.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_Hotmail.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_hsskin.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_jemster.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_jemsterie.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_jemsteruk.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_jobsearch.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_Mails.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_MobileSidewalk.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_new.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_premium.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_reun.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_ringtones.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_searchfor.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_searchgo.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_weather.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Default_yellowpages.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\editblbuttons.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\email-t1-bg.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\icons2.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\ie_games_icon.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\ie_video.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\keywords.idx
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\keywords1.dat
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\layout.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\linkpathlegal.txt
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\progress.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\s_icons_buttons.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\sales_buttons.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\sdfmodifier.xml
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\t2_bg.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\theweb.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\top7.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\Top7_theweb.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\tsd_bg.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\zango_btn.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\1\zango_ie_menu.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\btntrans.idx
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\btntrans1.dat
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\buttondir.txt
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\components.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\cursors.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_1000.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_2000.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_3000.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bar.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bbar1.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_logos.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_other.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\d_icons_weather.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\default.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_511745-514279.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_categorize.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_comparison.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-Mails.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-people.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_favorites.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_Games.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_Hide.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_hotbarcom.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_Hotmail.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_hsskin.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_jemster.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_jemsterie.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_jemsteruk.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_jobsearch.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_Mails.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_MobileSidewalk.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_new.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_premium.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_reun.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_ringtones.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_searchfor.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_searchgo.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_weather.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Default_yellowpages.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\editblbuttons.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-548964.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-9595.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\email-t1-bg.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\icons2.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\ie_games_icon.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\ie_video.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\keywords.idx
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\keywords1.dat
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\layout.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\linkpathlegal.txt
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\progress.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\s_icons_buttons.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\sales_buttons.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\sdfmodifier.xml
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\t2_bg.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\theweb.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\top7.cdf
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\Top7_theweb.mnu
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\tsd_bg.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\zango_btn.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\2\zango_ie_menu.res
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\buttondir.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\cursors.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_weather.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\default.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\editblbuttons.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\icons2.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_games_icon.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_video.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords1.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\layout.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\progress.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\sdfmodifier.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\t2_bg.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\top7.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\tsd_bg.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_btn.xip
C:\Documents and Settings\Lewis\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_ie_menu.xip
C:\Documents and Settings\Valerie\Application Data\iWinArcade
C:\Documents and Settings\Valerie\Application Data\iWinArcade\DesktopAlerts\Gamescache.xml
C:\Documents and Settings\Valerie\Application Data\iWinArcade\DesktopAlerts\Newscache.xml
C:\Documents and Settings\Valerie\Application Data\Zango
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\1.sdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\3251993.sdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\3893245.sdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\600583.sdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\819382.sdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\domains.txt
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\17040
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\18906
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20365
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\27503
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\281075
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\32148
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\33697
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\34123
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\378205
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\427075
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449626
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\481176
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\482360
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\52335
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6292
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64446
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\67469
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69911
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737665
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738022
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\744260
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745021
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745304
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\748176
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753300
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753335
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753346
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79246
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\86587
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89200
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93899
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\95615
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\97498
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\dynamic\ustat\3662.dat
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\btntrans.idx
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\btntrans1.dat
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\buttondir.txt
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\components.cdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\cursors.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_1000.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_2000.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_3000.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bar.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bbar1.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_logos.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_other.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\d_icons_weather.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\default.cdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_511745-514279.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-ca.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-us.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_categorize.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_comparison.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-Mails.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-people.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_favorites.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_Games.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_Hide.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_hotbarcom.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_Hotmail.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_hsskin.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_jemster.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_jemsterie.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_jemsteruk.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_jobsearch.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_Mails.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_MobileSidewalk.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_new.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_premium.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_reun.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_ringtones.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_searchfor.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_searchgo.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_weather.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Default_yellowpages.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\editblbuttons.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\email-t1-bg.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\icons2.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\ie_games_icon.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\ie_video.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\keywords.idx
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\keywords1.dat
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\layout.cdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\linkpathlegal.txt
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\progress.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\s_icons_buttons.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\sales_buttons.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\sdfmodifier.xml
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\t2_bg.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\theweb.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\top7.cdf
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\Top7_theweb.mnu
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\tsd_bg.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\zango_btn.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\1\zango_ie_menu.res
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\buttondir.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\cursors.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_weather.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\default.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\editblbuttons.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\icons2.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_games_icon.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_video.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords1.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\layout.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\progress.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\sdfmodifier.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\t2_bg.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\top7.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\tsd_bg.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_btn.xip
C:\Documents and Settings\Valerie\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_ie_menu.xip
C:\Program Files\iWin.com
C:\Program Files\iWin.com\Christmasville\BASS.DLL
C:\Program Files\iWin.com\Christmasville\Christmasville.ifn
C:\Program Files\iWin.com\Christmasville\GameLauncher.exe
C:\Program Files\iWin.com\Escape From Paradise\CastTemplate.cst
C:\Program Files\iWin.com\Escape From Paradise\Dirapi.dll
C:\Program Files\iWin.com\Escape From Paradise\Escape.ifn
C:\Program Files\iWin.com\Escape From Paradise\GameLauncher.exe
C:\Program Files\iWin.com\Escape From Paradise\Iml32.dll
C:\Program Files\iWin.com\Escape From Paradise\Proj.dll
C:\Program Files\iWin.com\Escape From Paradise\SharedCast.cct
C:\Program Files\iWin.com\Escape From Paradise\Xtras\budapi.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\DirectSound.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\MacroMix.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Mix\AVI Agent.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Mix\Flash Agent.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Mix\JPEG Agent.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Mix\Mix Services.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Mix\Photoshop 3.0 Import.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Mix\Photoshop CLUT Import.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Net Support\INetURL.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\Net Support\NetFile.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Core\TextXtra.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\FILEIO.X32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\Flash Asset\Flash Asset Options.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\Flash Asset\Flash Asset.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\Font Asset.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\Font Xtra.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\Shockwave 3D Asset.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\Sound Control.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\SWADCmpr.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Media Element\Text Asset.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Scripting\FileIo.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Scripting\NetLingo.x32
C:\Program Files\iWin.com\Escape From Paradise\Xtras\Scripting\UIHelper.x32
C:\Program Files\Zango
C:\Program Files\Zango\bin\10.1.181.0\arrow.ico
C:\Program Files\Zango\bin\10.1.181.0\copyright.txt
C:\Program Files\Zango\bin\10.1.181.0\CoreSrv.dll
C:\Program Files\Zango\bin\10.1.181.0\firefox\extensions\components\npclntax.xpt
C:\Program Files\Zango\bin\10.1.181.0\firefox\extensions\install.rdf
C:\Program Files\Zango\bin\10.1.181.0\firefox\extensions\plugins\npclntax_ZangoSA.dll
C:\Program Files\Zango\bin\10.1.181.0\HostIE.dll
C:\Program Files\Zango\bin\10.1.181.0\HostOE.dll
C:\Program Files\Zango\bin\10.1.181.0\HostOL.dll
C:\Program Files\Zango\bin\10.1.181.0\InstIE.dll
C:\Program Files\Zango\bin\10.1.181.0\link.ico
C:\Program Files\Zango\bin\10.1.181.0\OEAddOn.exe
C:\Program Files\Zango\bin\10.1.181.0\Srv.exe
C:\Program Files\Zango\bin\10.1.181.0\Toolbar.dll
C:\Program Files\Zango\bin\10.1.181.0\Wallpaper.dll
C:\Program Files\Zango\bin\10.1.181.0\Weather.exe
C:\Program Files\Zango\bin\10.1.181.0\WeSkin.dll
C:\Program Files\Zango\bin\10.1.181.0\ZangoSA.exe
C:\Program Files\Zango\bin\10.1.181.0\ZangoSAAX.dll
C:\Program Files\Zango\bin\10.1.181.0\ZangoSADF.exe
C:\Program Files\Zango\bin\10.1.181.0\ZangoSAHook.dll
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\_000005_.tmp.dll
d:\PROGRA~1\IWINGA~1\IWINGA~1.DLL

.
((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))
.

2008-02-13 10:30 . 2008-02-13 10:30 d——– C:\WINDOWS\LastGood
2008-02-12 21:20 . 2006-02-28 06:00 388,608 –a—— C:\kmd.exe
2008-02-12 15:34 . 2008-02-13 10:51 d——– C:\Documents and Settings\Lewis\Application Data\AVG7
2008-02-12 10:35 . 2008-02-13 10:27 d——– C:\Documents and Settings\Valerie\Application Data\AVG7
2008-02-11 22:44 . 2008-02-13 11:57 d——– C:\Documents and Settings\Jason\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2008-02-11 22:42 . 2008-02-11 22:42 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-02-11 22:41 . 2008-02-11 22:41 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-11 22:41 . 2008-02-12 12:12 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-02-09 18:17 . 2008-02-09 18:17 d——– C:\Program Files\iWin.com Games
2008-02-09 16:50 . 2005-11-08 15:38 57,344 –a—— C:\WINDOWS\system32\Big Kahuna Words.scr
2008-02-06 12:42 . 2008-02-06 12:42 d——– C:\Program Files\Trend Micro
2008-02-06 12:22 . 2008-02-06 12:22 d——– C:\Documents and Settings\Jason\Application Data\WeatherDPA
2008-01-19 17:04 . 2008-01-19 17:04 d——– C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-13 17:57 ——— d—–w C:\Program Files\lx_cats
2008-02-11 21:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-09 00:10 ——— d—–w C:\Documents and Settings\Jason\Application Data\LimeWire
2008-02-02 07:03 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-11 05:53 44,544 —-a-w C:\WINDOWS\system32\SET1F.tmp
2008-01-05 07:37 ——— d—–w C:\Program Files\Enigma Software Group
2007-12-30 20:05 ——— d—–w C:\Program Files\Common Files\DirectX
2007-12-30 20:04 ——— d—–w C:\Program Files\Common Files\Adobe
2007-12-30 20:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\InterTrust
2007-12-30 19:53 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-29 19:25 ——— d—–w C:\Documents and Settings\Valerie\Application Data\egamestoolbar
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\PlayFirst
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Magic Academy
2007-12-23 00:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Escape From Paradise
2007-12-22 21:03 ——— d—–w C:\Documents and Settings\Valerie\Application Data\iWin
2007-12-22 18:17 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-21 05:11 81,920 —-a-w C:\WINDOWS\system32\IEDFix.exe
2007-12-20 19:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\InterAction studios
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Flood Light Games
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Flood Light Games
2007-12-19 23:01 347,136 —-a-w C:\WINDOWS\system32\SET35.tmp
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-08 05:21 3,592,192 —-a-w C:\WINDOWS\system32\SET24.tmp
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\SET1B.tmp
2007-12-07 02:21 63,488 —-a-w C:\WINDOWS\system32\SET33.tmp
2007-12-07 02:21 6,066,176 —-a-w C:\WINDOWS\system32\SET2C.tmp
2007-12-07 02:21 52,224 —-a-w C:\WINDOWS\system32\SET25.tmp
2007-12-07 02:21 478,208 —-a-w C:\WINDOWS\system32\SET23.tmp
2007-12-07 02:21 459,264 —-a-w C:\WINDOWS\system32\SET26.tmp
2007-12-07 02:21 383,488 —-a-w C:\WINDOWS\system32\SET2E.tmp
2007-12-07 02:21 267,776 —-a-w C:\WINDOWS\system32\SET2A.tmp
2007-12-07 02:21 233,472 —-a-w C:\WINDOWS\system32\SET1C.tmp
2007-12-07 02:21 214,528 —-a-w C:\WINDOWS\system32\SET34.tmp
2007-12-07 02:21 124,928 —-a-w C:\WINDOWS\system32\SET36.tmp
2007-12-07 02:21 105,984 —-a-w C:\WINDOWS\system32\SET1E.tmp
2007-12-07 02:21 1,159,680 —-a-w C:\WINDOWS\system32\SET1D.tmp
2007-12-04 18:38 550,912 ——w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}]
2007-05-24 12:35 1897472 –a—— C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{1017A80C-6F09-4548-A84D-EDD6AC9525F0}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}
{E1BACF55-35E1-4E47-9247-2D48660E5545}

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}"= C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL [2007-05-24 12:35 1897472]

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="C:\Program Files\PDF\pdfSaver\pdfSaver3.exe" [2004-05-19 13:29 385024]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 14:39 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"pdfSaver3"="" []
"602PC SUITE PDF Saver"="C:\Program Files\Common Files\soft602\pdfSaver.exe" [2004-12-06 10:10 49152]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 11:45 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 23:10 98304]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 12:38 65536]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"LTMSG"="LTMSG.exe" [2003-07-14 09:52 40960 C:\WINDOWS\ltmsg.exe]
"SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-12 12:12 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-11 22:41 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-05-18 14:39:17 124912]

R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]
rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\CChat25.inf,PerUserRemove
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 12:27:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCRCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-13 12:27:33
ComboFix-quarantined-files.txt 2008-02-13 18:27:19
ComboFix2.txt 2008-02-13 04:55:00
ComboFix3.txt 2008-02-13 04:47:28
ComboFix4.txt 2008-02-13 03:26:54
.
2008-02-13 18:02:05 — E O F —
Now Hijackthis Log: Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:28:03 PM, on 2/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O3 - Toolbar: (no name) - {E1BACF55-35E1-4E47-9247-2D48660E5545} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1409082233-115176313-725345543-1005\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Valerie')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Valerie')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 Startup: PowerReg Scheduler V3.exe (User 'Valerie')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 User Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Valerie')
O4 - S-1-5-21-1409082233-115176313-725345543-1005 User Startup: PowerReg Scheduler V3.exe (User 'Valerie')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire…loadControl.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe

–
End of file - 6499 bytes

LDTate

Post #12February 14, 2008, 5:44 PM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\SET1F.tmp
C:\WINDOWS\system32\SET35.tmp
C:\WINDOWS\system32\SET24.tmp
C:\WINDOWS\system32\SET1B.tmp
C:\WINDOWS\system32\SET33.tmp
C:\WINDOWS\system32\SET2C.tmp
C:\WINDOWS\system32\SET25.tmp
C:\WINDOWS\system32\SET23.tmp
C:\WINDOWS\system32\SET26.tmp
C:\WINDOWS\system32\SET2E.tmp
C:\WINDOWS\system32\SET2A.tmp
C:\WINDOWS\system32\SET1C.tmp
C:\WINDOWS\system32\SET34.tmp
C:\WINDOWS\system32\SET1E.tmp
C:\WINDOWS\system32\SET1D.tmp
C:\WINDOWS\system32\SET36.tmp

Folder::
C:\Program Files\iWin.com Games
C:\Documents and Settings\Valerie\Application Data\iWin

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

Jason2001F350

Post #13February 14, 2008, 7:06 PM UTC

Computer still seems to be behaving fine. Everything seems to be working. Here are the new logs. ComboFix 08-02-13.2 - Jason 2008-02-14 12:58:54.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.674 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\SET1B.tmp
C:\WINDOWS\system32\SET1C.tmp
C:\WINDOWS\system32\SET1D.tmp
C:\WINDOWS\system32\SET1E.tmp
C:\WINDOWS\system32\SET1F.tmp
C:\WINDOWS\system32\SET23.tmp
C:\WINDOWS\system32\SET24.tmp
C:\WINDOWS\system32\SET25.tmp
C:\WINDOWS\system32\SET26.tmp
C:\WINDOWS\system32\SET2A.tmp
C:\WINDOWS\system32\SET2C.tmp
C:\WINDOWS\system32\SET2E.tmp
C:\WINDOWS\system32\SET33.tmp
C:\WINDOWS\system32\SET34.tmp
C:\WINDOWS\system32\SET35.tmp
C:\WINDOWS\system32\SET36.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Valerie\Application Data\iWin
C:\Program Files\iWin.com Games

.
((((((((((((((((((((((((( Files Created from 2008-01-14 to 2008-02-14 )))))))))))))))))))))))))))))))
.

2008-02-13 12:47 . 2008-02-13 12:47 d——– C:\Documents and Settings\Valerie\Application Data\iWinArcade
2008-02-13 12:47 . 2008-02-13 12:47 d——– C:\Documents and Settings\All Users\Application Data\iWin Games
2008-02-12 21:20 . 2006-02-28 06:00 388,608 –a—— C:\kmd.exe
2008-02-12 15:34 . 2008-02-13 10:51 d——– C:\Documents and Settings\Lewis\Application Data\AVG7
2008-02-12 10:35 . 2008-02-14 09:58 d——– C:\Documents and Settings\Valerie\Application Data\AVG7
2008-02-11 22:44 . 2008-02-14 12:30 d——– C:\Documents and Settings\Jason\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2008-02-11 22:42 . 2008-02-11 22:42 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-02-11 22:41 . 2008-02-11 22:41 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-11 22:41 . 2008-02-12 12:12 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-02-09 16:50 . 2005-11-08 15:38 57,344 –a—— C:\WINDOWS\system32\Big Kahuna Words.scr
2008-02-06 12:42 . 2008-02-06 12:42 d——– C:\Program Files\Trend Micro
2008-02-06 12:22 . 2008-02-06 12:22 d——– C:\Documents and Settings\Jason\Application Data\WeatherDPA
2008-01-19 17:04 . 2008-01-19 17:04 d——– C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 18:30 ——— d—–w C:\Program Files\lx_cats
2008-02-13 18:45 ——— d—–w C:\Program Files\Google
2008-02-13 18:45 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-09 00:10 ——— d—–w C:\Documents and Settings\Jason\Application Data\LimeWire
2008-02-02 07:03 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-05 07:37 ——— d—–w C:\Program Files\Enigma Software Group
2007-12-30 20:05 ——— d—–w C:\Program Files\Common Files\DirectX
2007-12-30 20:04 ——— d—–w C:\Program Files\Common Files\Adobe
2007-12-30 20:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\InterTrust
2007-12-30 19:53 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-29 19:25 ——— d—–w C:\Documents and Settings\Valerie\Application Data\egamestoolbar
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\PlayFirst
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Magic Academy
2007-12-23 00:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Escape From Paradise
2007-12-22 18:17 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-21 05:11 81,920 —-a-w C:\WINDOWS\system32\IEDFix.exe
2007-12-20 19:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\InterAction studios
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Flood Light Games
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Flood Light Games
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ——w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}]
2007-05-24 12:35 1897472 –a—— C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{1017A80C-6F09-4548-A84D-EDD6AC9525F0}
{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}
{E1BACF55-35E1-4E47-9247-2D48660E5545}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}"= C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL [2007-05-24 12:35 1897472]

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="C:\Program Files\PDF\pdfSaver\pdfSaver3.exe" [2004-05-19 13:29 385024]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 14:39 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"pdfSaver3"="" []
"602PC SUITE PDF Saver"="C:\Program Files\Common Files\soft602\pdfSaver.exe" [2004-12-06 10:10 49152]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 11:45 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 23:10 98304]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 12:38 65536]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"LTMSG"="LTMSG.exe" [2003-07-14 09:52 40960 C:\WINDOWS\ltmsg.exe]
"SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-12 12:12 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-11 22:41 219136]

C:\Documents and Settings\Valerie\Start Menu\Programs\Startup\
iWin Desktop Alerts.lnk - C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe [2008-02-13 12:47:04 101888]
PowerReg Scheduler V3.exe [2007-07-14 17:53:13 225280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-05-18 14:39:17 124912]

R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]
rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\CChat25.inf,PerUserRemove
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-14 12:59:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCRCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-14 13:00:17
ComboFix-quarantined-files.txt 2008-02-14 19:00:10
ComboFix2.txt 2008-02-13 18:27:34
ComboFix3.txt 2008-02-13 04:55:00
ComboFix4.txt 2008-02-13 04:47:28
ComboFix5.txt 2008-02-13 03:26:54
.
2008-02-13 18:02:05 — E O F — HiJackThis Log Now: Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:05:52 PM, on 2/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O3 - Toolbar: (no name) - {E1BACF55-35E1-4E47-9247-2D48660E5545} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire…loadControl.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe

–
End of file - 5673 bytes

LDTate

Post #14February 14, 2008, 9:59 PM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe

Folder::
C:\Documents and Settings\Valerie\Application Data\iWinArcade
C:\Documents and Settings\All Users\Application Data\iWin Games

Jason2001F350

Post #15February 15, 2008, 7:58 PM UTC

Computer still acting the same, seems to be working fine. Here are the new logs. ComboFix 08-02-13.2 - Jason 2008-02-15 13:52:58.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.703 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\iWin Games
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_all.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_dl.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_next.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\res\btn_prev.png
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\WebUpdater.exe
C:\Documents and Settings\Valerie\Application Data\iWinArcade
C:\Documents and Settings\Valerie\Application Data\iWinArcade\DesktopAlerts\Gamescache.xml
C:\Documents and Settings\Valerie\Application Data\iWinArcade\DesktopAlerts\Newscache.xml

.
((((((((((((((((((((((((( Files Created from 2008-01-15 to 2008-02-15 )))))))))))))))))))))))))))))))
.

2008-02-12 21:20 . 2006-02-28 06:00 388,608 –a—— C:\kmd.exe
2008-02-12 15:34 . 2008-02-15 12:20 d——– C:\Documents and Settings\Lewis\Application Data\AVG7
2008-02-12 10:35 . 2008-02-15 09:28 d——– C:\Documents and Settings\Valerie\Application Data\AVG7
2008-02-11 22:44 . 2008-02-15 13:45 d——– C:\Documents and Settings\Jason\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-11 22:42 . 2008-02-11 22:42 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2008-02-11 22:42 . 2008-02-11 22:42 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-02-11 22:41 . 2008-02-11 22:41 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-11 22:41 . 2008-02-12 12:12 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-02-09 16:50 . 2005-11-08 15:38 57,344 –a—— C:\WINDOWS\system32\Big Kahuna Words.scr
2008-02-06 12:42 . 2008-02-06 12:42 d——– C:\Program Files\Trend Micro
2008-02-06 12:22 . 2008-02-06 12:22 d——– C:\Documents and Settings\Jason\Application Data\WeatherDPA
2008-01-19 17:04 . 2008-01-19 17:04 d——– C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-15 19:45 ——— d—–w C:\Program Files\lx_cats
2008-02-14 19:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-13 18:45 ——— d—–w C:\Program Files\Google
2008-02-09 00:10 ——— d—–w C:\Documents and Settings\Jason\Application Data\LimeWire
2008-02-02 07:03 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-05 07:37 ——— d—–w C:\Program Files\Enigma Software Group
2007-12-30 20:05 ——— d—–w C:\Program Files\Common Files\DirectX
2007-12-30 20:04 ——— d—–w C:\Program Files\Common Files\Adobe
2007-12-30 20:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\InterTrust
2007-12-30 19:53 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-29 19:25 ——— d—–w C:\Documents and Settings\Valerie\Application Data\egamestoolbar
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\PlayFirst
2007-12-23 01:42 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Magic Academy
2007-12-23 00:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Escape From Paradise
2007-12-22 18:17 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-21 05:11 81,920 —-a-w C:\WINDOWS\system32\IEDFix.exe
2007-12-20 19:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\InterAction studios
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\Valerie\Application Data\Flood Light Games
2007-12-20 17:57 ——— d—–w C:\Documents and Settings\All Users\Application Data\Flood Light Games
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ——w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}]
2007-05-24 12:35 1897472 –a—— C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{1017A80C-6F09-4548-A84D-EDD6AC9525F0}
{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}
{E1BACF55-35E1-4E47-9247-2D48660E5545}
{2318C2B1-4965-11D4-9B18-009027A5CD4F}

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E}"= C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL [2007-05-24 12:35 1897472]

[HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-85b2-bc27fe9aae2e}]
[HKEY_CLASSES_ROOT\egamestoolbar.EGAMESTOOLBAR]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="C:\Program Files\PDF\pdfSaver\pdfSaver3.exe" [2004-05-19 13:29 385024]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-18 14:39 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"pdfSaver3"="" []
"602PC SUITE PDF Saver"="C:\Program Files\Common Files\soft602\pdfSaver.exe" [2004-12-06 10:10 49152]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 11:45 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 23:10 98304]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 12:38 65536]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"LTMSG"="LTMSG.exe" [2003-07-14 09:52 40960 C:\WINDOWS\ltmsg.exe]
"SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-12 12:12 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-11 22:41 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-05-18 14:39:17 124912]

R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]
rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\CChat25.inf,PerUserRemove
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-15 13:54:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCRCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-15 13:54:25
ComboFix-quarantined-files.txt 2008-02-15 19:54:18
ComboFix2.txt 2008-02-14 19:00:18
ComboFix3.txt 2008-02-13 18:27:34
ComboFix4.txt 2008-02-13 04:55:00
ComboFix5.txt 2008-02-13 04:47:28
.
2008-02-13 18:02:05 — E O F —
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:57:26 PM, on 2/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\soft602\pdfSaver.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: eGames Toolbar - {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - C:\PROGRA~1\EGAMES~1\EGAMES~1.DLL
O3 - Toolbar: (no name) - {E1BACF55-35E1-4E47-9247-2D48660E5545} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe"
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire…loadControl.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe

–
End of file - 5673 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Help Removing AV System Care

✨ Ask AI

Ask AI