Spyware / Malware / Virus Removal

[Resolved] I am unable to diagnose my problem, any assistance wou

2 min read

Looking for the outcome? Ask AI

LDDI Topic Starter

Post #1February 15, 2008, 3:31 AM UTC

Hi, I seem to have been hit by something. From my scanning with Symantec, Ad-Aware, and Spybot S&D, I believe that I might be infected with either metajuan and/or vundo. I've browsed through the other threads regarding these two, and have attempted some of the fixes advised. My symptoms however, seem to be slightly different.

Sometimes, but not very often, Explorer will suddenly shut down and not start up again. I'm thinking this might be related to metajuan as it only happens when Spybot tells me metajuan is trying to write to my registry. Spybot also detects various things trying to write to my registry, almost two every second. I'm not entirely sure, but it looks very suspicious.

Whenever I boot up my computer, I receive an error message telling me that some random dll has failed to load. The text string seems to vary upon each boot. Further, IE attempts to load up a page upon booting, but I am disconnected from the Internet (disabled my wifi) upon booting so it is unable to load.

My computer doesn't however, seem to suffer any significant slowdown other than the expected decrease from Spybot preventing all of the registry edits. I also do not seem to be affected by any pop-ups. There was a brief period where TrustedAntiVirus attempted to install itself to my system, but I was able to prevent this and have not heard from it since. I'm not sure if it's a related issue.

My machine was attacked by Brontok the other day while I was fixing one of the computers at work, but I was able to solve that problem. I'm mentioning it anyway because it might be related. It was mostly careless of me, I didn't check my flash disk for any problems before transferring to my laptop to get some files. It's theoretically Brontok free now though.

I've run VundoFix, but it didn't seem to turn up anything. Similarly, Spybot turned up a few results and got rid of them, but the problem still persists. I've cleaned everything with CCleaner a couple of times. Symantec also doesn't seem to be able to find anything.

When I boot up into Linux, I have no problems at all. While Linux is my preferred OS, I am required by work to use some of the programs in Windows. Any aid in addressing this problem would be very much appreciated.

The specs of my machine are as follows:

Acer Aspire 4720
Core 2 Duo processor
1.66 Ghz
2GB DDR2
160 GB HDD

I have posted the HiJackThis log below. Thanks in advance for any help provided.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:55 AM, on 2/15/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Users\MASTER~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.ph.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ph.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\MASTER~1\AppData\Local\Temp\rqroo.dll,#1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\MASTER~1\AppData\Local\Temp\rcuqboeo.dll",run
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\MASTER~1\AppData\Local\Temp\jkheb.dll,c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

–
End of file - 13991 bytes

Again, thanks in advance for any aid provided.

LDTate

Post #2February 20, 2008, 1:39 AM UTC

Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish

LDDI

Post #3February 21, 2008, 1:31 AM UTC

Hi, I've run the two programs and have posted the two logs below.

ComboFix 08-02-21 - MasterRaven 2008-02-21 9:18:56.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.895 [GMT 8:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\x64

.
((((((((((((((((((((((((( Files Created from 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))
.

2008-02-19 14:59 . 2008-02-19 14:59 18,347,008 –a—— C:\Windows\System32\imageres.dll
2008-02-19 08:53 . 2008-01-10 13:50 1,244,672 –a—— C:\Windows\System32\mcmde.dll
2008-02-15 11:28 . 2008-02-15 11:28 d——– C:\Program Files\Trend Micro
2008-02-15 08:51 . 2008-02-15 08:51 d——– C:\VundoFix Backups
2008-02-15 08:29 . 2008-02-15 08:29 194,560 –a—— C:\Windows\System32\WebClnt.dll
2008-02-15 08:29 . 2008-02-15 08:29 110,080 –a—— C:\Windows\System32\drivers\mrxdav.sys
2008-02-15 08:19 . 2008-02-15 08:19 3,504,696 –a—— C:\Windows\System32\ntkrnlpa.exe
2008-02-15 08:18 . 2008-02-15 08:18 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-15 08:18 . 2008-02-15 08:18 1,686,528 –a—— C:\Windows\System32\gameux.dll
2008-02-15 08:17 . 2008-02-15 08:17 d——– C:\Windows\Internet Logs
2008-02-14 16:52 . 2008-02-14 17:05 d——– C:\Users\All Users\Spybot - Search & Destroy
2008-02-14 16:52 . 2008-02-14 17:05 d——– C:\ProgramData\Spybot - Search & Destroy
2008-02-14 16:52 . 2008-02-14 16:52 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-14 16:20 . 2008-02-14 16:22 d——– C:\HijackThis
2008-02-14 11:12 . 2007-10-18 08:51 172,032 –a—— C:\Windows\System32\igfxres.dll
2008-02-14 10:17 . 2008-02-14 10:17 d——– C:\TEMP\Adobe InDesign CS2
2008-02-10 23:39 . 2008-02-10 23:48 d——– C:\Program Files\Immortal Defense
2008-02-10 12:40 . 2008-02-10 12:40 d——– C:\TEMP\Kai
2008-02-09 12:12 . 2008-02-09 16:46 d——– C:\Disk Images
2008-02-04 14:41 . 2008-02-04 14:59 d——– C:\Users\MasterRaven\AppData\Roaming\FontCreator
2008-02-04 14:41 . 2008-02-04 14:41 d——– C:\Program Files\High-Logic
2008-02-04 13:32 . 2008-02-04 13:32 d——– C:\Windows\PrimoPDF
2008-02-04 13:32 . 2008-02-04 13:32 d——– C:\Program Files\activePDF
2008-02-04 13:32 . 2006-12-12 04:12 176,235 –a—— C:\Windows\System32\Primomonnt.dll
2008-02-01 11:59 . 2008-01-12 18:32 23,904 –a—— C:\Windows\System32\drivers\COH_Mon.sys
2008-02-01 11:59 . 2008-01-15 09:54 10,537 –a—— C:\Windows\System32\drivers\COH_Mon.cat
2008-02-01 11:59 . 2008-01-15 05:28 706 –a—— C:\Windows\System32\drivers\COH_Mon.inf
2008-01-31 10:01 . 2008-01-31 10:01 d——– C:\Users\MasterRaven\.pcgen
2008-01-31 10:00 . 2008-01-31 10:00 d——– C:\Program Files\OpenRPG
2008-01-31 09:56 . 2008-01-31 09:57 d——– C:\Program Files\PCGen
2008-01-31 09:55 . 2008-01-31 09:58 d——– C:\Python25
2008-01-31 09:15 . 2008-01-31 09:15 d——– C:\Program Files\Redblade 3.5e
2008-01-30 10:27 . 2008-01-30 10:27 d——– C:\Windows\System32\Kaspersky Lab
2008-01-30 10:27 . 2008-01-30 10:27 d——– C:\Users\All Users\Kaspersky Lab
2008-01-30 10:27 . 2008-01-30 10:27 d——– C:\ProgramData\Kaspersky Lab
2008-01-28 18:19 . 2008-02-14 13:55 d——– C:\Users\MasterRaven\AppData\Roaming\OpenOffice.org2
2008-01-28 18:16 . 2008-01-28 18:17 d——– C:\Program Files\OpenOffice.org 2.3
2008-01-26 11:47 . 2008-01-26 11:48 d——– C:\TEMP\MORESNDS
2008-01-26 11:46 . 2008-01-26 11:46 d——– C:\TEMP\VID_ANIM
2008-01-26 11:46 . 2008-01-26 11:46 d——– C:\TEMP\SOUNDS
2008-01-21 13:33 . 2008-01-22 23:05 43 –a—— C:\Windows\SCNDRVU.INI
2008-01-21 13:32 . 1996-11-05 16:13 299,008 –a—— C:\Windows\uninst.exe
2008-01-21 13:32 . 1995-09-15 10:51 69,632 –a—— C:\Windows\TWUNK_32.728

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 01:19 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\Free Download Manager
2008-02-15 00:27 ——— d—–w C:\ProgramData\Symantec
2008-02-15 00:27 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-02-15 00:19 803,328 —-a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-15 00:15 824,832 —-a-w C:\Windows\System32\wininet.dll
2008-02-15 00:15 56,320 —-a-w C:\Windows\System32\iesetup.dll
2008-02-15 00:15 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-15 00:15 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2008-02-14 02:21 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-03 02:05 ——— d—–w C:\Program Files\MyPhoneExplorer
2008-02-01 08:15 ——— d—–w C:\Program Files\Norton Internet Security
2008-01-23 23:48 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\Notepad++
2008-01-13 14:53 ——— d—–w C:\Program Files\Java
2008-01-13 14:49 ——— d—–w C:\Program Files\Common Files\Java
2008-01-13 00:36 ——— d—–w C:\ProgramData\Microsoft Help
2008-01-13 00:36 ——— d—–w C:\Program Files\Microsoft Works
2008-01-11 04:26 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\MyPhoneExplorer
2008-01-10 00:16 ——— d—–w C:\Program Files\Windows Mail
2008-01-09 12:36 211,000 —-a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-09 12:36 11,776 —-a-w C:\Windows\System32\sbunattend.exe
2008-01-09 12:36 1,060,920 —-a-w C:\Windows\system32\drivers\ntfs.sys
2008-01-09 12:36 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-07 10:04 ——— d—–w C:\Program Files\SyncToy 2.0 Beta
2008-01-07 10:03 ——— d—–w C:\Program Files\Microsoft SQL Server Compact Edition
2008-01-07 01:32 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\acer
2008-01-06 05:34 ——— d—–w C:\Program Files\yWriter4
2008-01-06 03:48 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\CyberLink
2008-01-05 03:09 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-01-05 03:08 ——— d—–w C:\Program Files\Microsoft SQL Server
2008-01-05 03:05 ——— d—–w C:\Program Files\Microsoft.NET
2008-01-05 02:32 ——— d—–w C:\Program Files\Microsoft Visual Studio 9.0
2008-01-05 02:31 ——— d—–w C:\Program Files\Microsoft Synchronization Services
2008-01-05 02:03 ——— d—–w C:\Program Files\Microsoft SDKs
2008-01-05 01:58 88,576 —-a-w C:\Windows\System32\infocardapi.dll
2008-01-05 01:58 579,584 —-a-w C:\Windows\System32\icardagt.exe
2008-01-05 01:58 11,776 —-a-w C:\Windows\System32\icardres.dll
2008-01-05 01:57 779,800 —-a-w C:\Windows\System32\PresentationNative_v0300.dll
2008-01-05 01:57 350,744 —-a-w C:\Windows\System32\PresentationHost.exe
2008-01-05 01:57 33,304 —-a-w C:\Windows\System32\PresentationHostProxy.dll
2008-01-05 01:57 106,520 —-a-w C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2008-01-05 01:39 96,760 —-a-w C:\Windows\System32\dfshim.dll
2008-01-05 01:39 84,480 —-a-w C:\Windows\System32\mscories.dll
2008-01-05 01:39 41,984 —-a-w C:\Windows\System32\netfxperf.dll
2008-01-05 01:39 282,112 —-a-w C:\Windows\System32\mscoree.dll
2008-01-05 01:39 158,720 —-a-w C:\Windows\System32\mscorier.dll
2008-01-05 01:38 ——— d—–w C:\Program Files\Google
2008-01-04 16:23 ——— d—–w C:\Program Files\NetDog
2008-01-04 13:00 ——— d—–w C:\Program Files\DivX
2008-01-03 02:48 ——— d—–w C:\Program Files\Graph
2008-01-02 08:50 ——— d—–w C:\Program Files\Mudbox
2007-12-28 03:21 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\CB Model Pro
2007-12-28 03:21 ——— d—–w C:\Program Files\CB Model Pro
2007-12-28 03:19 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-28 03:19 ——— d—–w C:\Program Files\Ulead Systems
2007-12-28 02:01 ——— d—–w C:\Program Files\Blender Foundation
2007-12-28 00:50 ——— d—–w C:\Program Files\Real Desktop
2007-12-28 00:20 ——— d—–w C:\ProgramData\Yahoo!
2007-12-27 13:00 ——— d—–w C:\Program Files\Yahoo!
2007-12-27 06:29 ——— d—–w C:\Program Files\Alex Feinman
2007-12-27 01:48 ——— d—–w C:\ProgramData\Adobe Systems
2007-12-27 01:46 ——— d—–w C:\Program Files\Common Files\Adobe Systems Shared
2007-12-26 09:23 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\Corel
2007-12-26 08:58 ——— d—–w C:\Program Files\Corel
2007-12-26 05:14 ——— d—–w C:\ProgramData\Stardock
2007-12-26 05:14 ——— d—–w C:\Program Files\Stardock
2007-12-26 03:50 ——— d—–w C:\Program Files\Common Files\xing shared
2007-12-26 03:49 ——— d—–w C:\Program Files\Real
2007-12-26 03:49 ——— d—–w C:\Program Files\Common Files\Real
2007-12-26 02:54 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\PeerNetworking
2007-12-26 02:47 ——— d—–w C:\ProgramData\Forge of Games
2007-12-26 02:38 ——— d—–w C:\ProgramData\FreeDownloadManager.ORG
2007-12-26 02:38 ——— d—–w C:\Program Files\Free Download Manager
2007-12-26 02:31 ——— d—–w C:\Program Files\CDisplay
2007-12-26 01:41 9,344 —-a-w C:\Windows\system32\drivers\NSDriver.sys
2007-12-26 01:41 8,320 —-a-w C:\Windows\system32\drivers\AWRTRD.sys
2007-12-26 01:37 ——— d—–w C:\ProgramData\Lavasoft
2007-12-26 01:37 ——— d—–w C:\Program Files\Lavasoft
2007-12-26 01:37 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-26 01:36 ——— d—–w C:\Program Files\Notepad++
2007-12-26 00:42 ——— d—–w C:\ProgramData\Yahoo! Companion
2007-12-25 13:09 ——— d—–w C:\Program Files\RocketDock
2007-12-25 08:42 174 –sha-w C:\Program Files\desktop.ini
2007-12-25 08:37 ——— d—–w C:\Program Files\Windows Calendar
2007-12-25 04:41 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-12-25 04:41 ——— d—–w C:\Program Files\Common Files\L&H
2007-12-25 04:30 ——— d—–w C:\Program Files\CCleaner
2007-12-25 04:19 8,147,968 —-a-w C:\Windows\System32\wmploc.DLL
2007-12-25 04:19 7,680 —-a-w C:\Windows\System32\spwmp.dll
2007-12-25 04:19 4,096 —-a-w C:\Windows\System32\dxmasf.dll
2007-12-25 04:19 356,864 —-a-w C:\Windows\System32\MediaMetadataHandler.dll
2007-12-25 04:18 1,191,936 —-a-w C:\Windows\System32\msxml3.dll
2007-12-25 04:17 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-12-25 04:16 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-25 04:16 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-12-25 04:15 1,335,296 —-a-w C:\Windows\System32\msxml6.dll
2007-12-25 04:13 84,480 —-a-w C:\Windows\System32\INETRES.dll
2007-12-25 04:13 737,792 —-a-w C:\Windows\System32\inetcomm.dll
2007-12-25 04:11 84,992 —-a-w C:\Windows\system32\drivers\srvnet.sys
2007-12-25 04:11 58,368 —-a-w C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-25 04:11 130,048 —-a-w C:\Windows\system32\drivers\srv2.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 13:58 495616]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2007-12-16 20:39 2449455]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-07 06:55 1006264]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-05-23 13:35 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-05-23 13:35 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-05-23 13:35 81920]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-06-13 09:50 174872]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-28 16:29 4472832 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 10:03 857648]
"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2007-06-29 11:16 707080]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 19:38 40048]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-12 06:00 1286144]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-26 07:33 457216]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-25 04:38 206952]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 12:44 107112]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-11-21 12:42 22696]
"Acer Tour"="" []
"PLFSet"="C:\Windows\PLFSet.dll" [2007-04-25 18:47 45056]
"eRecoveryService"="" []
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-23 06:49 151552]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-26 11:49 185896]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-10-18 09:19 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-10-18 09:18 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-10-18 09:18 133656]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe" [2007-09-12 18:27 492912]

C:\Users\MasterRaven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe [2007-07-21 01:57:16 2913584]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-05-18 22:16:02 727856]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-08-07 07:28:10 535336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds]
C:\Users\MASTER~1\AppData\Local\Temp\qommn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f4890386]
C:\Users\MASTER~1\AppData\Local\Temp\cdqgyycw.dll

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-26 07:34]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-26 07:34]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-26 07:34]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080215.002\IDSvix86.sys [2008-02-14 00:18]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-03 07:51]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-15 05:31]
R2 eDataSecurity Service;eDataSecurity Service;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-26 07:34]
R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-06-14 07:54]
R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-29 09:50]
R2 int15;int15;C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 23:12]
R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-25 03:57]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29]
R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-14 02:23]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-10-18 09:05]
R3 NETw4v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-06-21 04:51]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC);C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-06-12 15:38]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 19:55]
R3 winbondcir;Winbond IR Transceiver;C:\Windows\system32\DRIVERS\winbondcir.sys [2007-03-28 22:51]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-23 06:00]
S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-30 03:46]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 14:20]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 14:20]
S3 WSVD;WSVD;C:\Windows\system32\drivers\WSVD.sys [2006-09-19 21:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b2d710c-b29e-11dc-ac37-c8d42b03bcf9}]
\shell\AutoRun\command - G:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-11 11:59:59 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - willy.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 09:21:47
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\Windows\Explorer.exe [6.00.6000.16549]
-> C:\Program Files\RocketDock\RocketDock.dll
.
Completion time: 2008-02-21 9:22:31
.
2008-02-19 23:47:22 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:30:50 AM, on 2/21/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Users\MASTER~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\Explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.ph.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ph.acer.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\MASTER~1\AppData\Local\Temp\rcuqboeo.dll",run
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

–
End of file - 13077 bytes

LDTate

Post #4February 21, 2008, 1:46 AM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Users\MASTER~1\AppData\Local\Temp\qommn.dll
C:\Users\MASTER~1\AppData\Local\Temp\cdqgyycw.dll
C:\Users\MASTER~1\AppData\Local\Temp\rcuqboeo.dll

Folder::
C:\TEMP\Kai
C:\TEMP\MORESNDS
C:\TEMP\VID_ANIM
C:\TEMP\SOUNDS

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f4890386]

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

LDDI

Post #5February 21, 2008, 3:57 AM UTC last edited February 21, 2008, 4:00 AM UTC

Hi, my computer seems to be performing has been for the past few days. I'm getting fewer alerts from SpyBot though. Explorer shut down a few times while ComboFix was running, I'm not sure if this is normal so I'm mentioning it. Right after ComboFix ran, SpyBot alerted me to MSJuan attempting to adjust my registry. Below are the ComboFix and HiJackThis log files.

ComboFix 08-02-21 - MasterRaven 2008-02-21 11:49:00.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1036 [GMT 8:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Users\MasterRaven\Desktop\CFscript.txt
* Created a new restore point

FILE ::
C:\Users\MASTER~1\AppData\Local\Temp\cdqgyycw.dll
C:\Users\MASTER~1\AppData\Local\Temp\qommn.dll
C:\Users\MASTER~1\AppData\Local\Temp\rcuqboeo.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\TEMP\Kai
C:\TEMP\Kai\Admin\Admin\APPLIED SCHOLASTICS CONTACT.pmd
C:\TEMP\Kai\Admin\Admin\CSE and CEOE Program Fees 2007.doc
C:\TEMP\Kai\Admin\Admin\CSE for T. Beth\CSE-ALABANG.XLS
C:\TEMP\Kai\Admin\Admin\CSE for T. Beth\CSE-CEBU.XLS
C:\TEMP\Kai\Admin\Admin\CSE for T. Beth\CSE-FAIRVIEW.xls
C:\TEMP\Kai\Admin\Admin\CSE for T. Beth\CSE-KATIPUNAN.xls
C:\TEMP\Kai\Admin\Admin\CSE for T. Beth\CSE-MAKATI.xls
C:\TEMP\Kai\Admin\Admin\CSE for T. Beth\Summary of CSE.xls
C:\TEMP\Kai\Admin\Admin\CSE Proposal.pmd
C:\TEMP\Kai\Admin\Admin\E-ticket for Cebu Teachers.doc
C:\TEMP\Kai\Admin\Admin\envelope.cdr
C:\TEMP\Kai\Admin\Admin\FALAR_315.docx
C:\TEMP\Kai\Admin\Admin\FINAL MARKETING.doc
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.1.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.2.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.3.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.4.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.5.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.6.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.7.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_August'07 for T.Beth\Inquiry_Aug.8.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_July '07 for T.Beth\Inquiry_ Jul. 27.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_July '07 for T.Beth\Inquiry_Jul.28.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_July '07 for T.Beth\Inquiry_Jul.29.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_July '07 for T.Beth\Inquiry_Jul.30.xls
C:\TEMP\Kai\Admin\Admin\Inquiry_July '07 for T.Beth\Inquiry_Jul.31.xls
C:\TEMP\Kai\Admin\Admin\Letter Head.pmd
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\BLUE FOLDER.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\BLUE FOLDER_315_July.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\BLUE_FOLDER_315_July.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\ER October 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\Monthly Sales_315_ October ' 07.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\Tar July_315_ 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\Tar_315_ October_ 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\315\Tar_July_315__2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Alabang\Monthly Report_Alabang Branch October 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Alabang\Monthly Report_Alabang Branch_September 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Alabang\MSA Alabang Student-Staff Ratio 2007.xlsx
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Alabang\MSA_ Metrics 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Monthly_Number_Of_Enrollees_2007.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Personal Information MSA-Cebu Employees.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales and Expenses Record (Aug - Oct 2007).doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales and Expenses Record (January to July ).doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales and Expenses Record (January to July 2007) 4.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales and Expenses Record (January to July 2007).doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales and Expenses Record (January to July 2007_3.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales and Expenses Record Cebu.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales and Expenses Record2(Aug - Oct 2007).doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales_and_Expenses_Record__January_to_July_2007_.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Sales_and_Expenses_Record__January_to_July_2007_2.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\service_fees.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\STUDENT-STAFF RATIO RECORD.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\Student_Staff_Ratio_Cebu_2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\STUDENT_STAFF_RATIO_RECORD.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Cebu\students-staff ratio Cebu.doc
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Fairview\EXPENSES_FAIRVIEW_OCTOBER '07.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Fairview\EXPENSES_FAIRVIEW_SEPTEMBER '07.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Fairview\fairview sales_OCTOBER_TUT[1]._Books.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Fairview\fairview sales_SEPTEMBER_TUT[1]._Books.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Fairview\FAIRVIEW SUMMARY OF MONTHLY EXPENSES '07.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Fairview\fairview summary of monthly sales.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Filinvest\3-Sales and Expenses 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Filinvest\antipolo_student-staff ratio.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Makati\Blue_folder__Sir_Jek_.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Makati\Monthly Report_Makati Branch_October 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Makati\Monthly Report_MAKATI Branch_September 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Makati\Sales___Expenses__January_July_2007_.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Monthly Contributions_July 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\PDC\MSA PDC Expenses.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\PDC\Petty Cash 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\PDC\student staff & summary of enrollees.xls
C:\TEMP\Kai\Admin\Admin\MSA Blue Folder\Summary for 2007.xls
C:\TEMP\Kai\Admin\Admin\MSA Hand-outs.xls
C:\TEMP\Kai\Admin\Admin\NCR Masterlist Private Schools 05-06.xls
C:\TEMP\Kai\Admin\Admin\PDC OR Status.xls
C:\TEMP\Kai\Admin\Admin\Programs Schedule 2007\Civil Service Sked 2007.doc
C:\TEMP\Kai\Admin\Admin\Programs Schedule 2007\hsetr and cetr for 2007 Aug.xls
C:\TEMP\Kai\Admin\Admin\Programs Schedule 2007\LAE Sked 2007.doc
C:\TEMP\Kai\Admin\Admin\Programs Schedule 2007\NMAT Sked 2007 april exam.doc
C:\TEMP\Kai\Admin\Admin\Programs Schedule 2007\NMAT Sked Sept-Dec 2007.doc
C:\TEMP\Kai\Admin\Admin\Programs Schedule 2007\PDC Schedules 2007.doc
C:\TEMP\Kai\Admin\Admin\Programs Schedule 2007\Schedules 2007.xls
C:\TEMP\Kai\Admin\Admin\Proposals\Authorization Letter BSP.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Bangko Sentral\Comparison Flight Details.xls
C:\TEMP\Kai\Admin\Admin\Proposals\Bangko Sentral\Correspondence - Bangko Sentral CSE Aug 22.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Bangko Sentral\Correspondence - Bangko Sentral CSE Aug 9.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Bangko Sentral\Correspondence - Bangko Sentral CSE.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Bangko Sentral\Flight Expenses - BSP Zamboanga and bacolod.txt
C:\TEMP\Kai\Admin\Admin\Proposals\COE ANNA REYES.docx
C:\TEMP\Kai\Admin\Admin\Proposals\Correspondence- CSE Natl Defense.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Correspondence-CSEE.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Correspondence-DSWD.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Correspondence - Child Jesus of Prague NCAE.doc
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Proposal 2.pmd
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Proposal 3.pmd
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Proposal 4.pmd
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Proposal 5.pmd
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Proposal.pdf
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Proposal.pmd
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Review Outline - DND.doc
C:\TEMP\Kai\Admin\Admin\Proposals\CSE Review Outline - PCSO.doc
C:\TEMP\Kai\Admin\Admin\Proposals\CSEE Review Outline - PCSO.doc
C:\TEMP\Kai\Admin\Admin\Proposals\DILG - MOA.doc
C:\TEMP\Kai\Admin\Admin\Proposals\DILG - Proposal.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Free Comprehensive Exam for Third Year Students.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Free Comprehensive Exam for Third Year Students.docx
C:\TEMP\Kai\Admin\Admin\Proposals\Free Seminar Proposal.pmd
C:\TEMP\Kai\Admin\Admin\Proposals\Letterhead - Lae Proposal.pdf
C:\TEMP\Kai\Admin\Admin\Proposals\MOA - Camp Aguinaldo.doc
C:\TEMP\Kai\Admin\Admin\Proposals\MSA_CSE_Proposal_Olongapo.pdf
C:\TEMP\Kai\Admin\Admin\Proposals\PDIC - Proposal CEOE.doc
C:\TEMP\Kai\Admin\Admin\Proposals\Program Information\MEMO on Program Information Aug 7 2007).doc
C:\TEMP\Kai\Admin\Admin\Proposals\Proposal College Entrance Tests Preparation.pdf
C:\TEMP\Kai\Admin\Admin\Proposals\Proposal Outreach.pdf
C:\TEMP\Kai\Admin\Admin\Proposals\Reply to BPLO .pmd
C:\TEMP\Kai\Admin\Admin\Proposals\Statement of Account - BSP La Union.pmd
C:\TEMP\Kai\Admin\Admin\Proposals\Theresa_Gales_COE.pdf
C:\TEMP\Kai\Admin\Admin\Seminar Report.doc
C:\TEMP\Kai\Admin\Admin\t[1].vic and t. loren.doc
C:\TEMP\Kai\Admin\BOI Requirements\Elizabeth_Landicho_CertMBA 001.jpg
C:\TEMP\Kai\Admin\BOI Requirements\Elizabeth_Landicho_CertMBA.jpg
C:\TEMP\Kai\Admin\BOI Requirements\Gr8 ideas.doc
C:\TEMP\Kai\Admin\BOI Requirements\labels.doc
C:\TEMP\Kai\Admin\BOI Requirements\Play Camp Daily Sessions.doc
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2006 HSETR-CETR\315 ACET PASSERS' 2006.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2006 HSETR-CETR\CETR Dry Run 2006.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2006 HSETR-CETR\CETR Quizzes.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2006 HSETR-CETR\HSETR Dryrun Results 2006.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2006 HSETR-CETR\HSETR QUIZZES 2006.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2006 HSETR-CETR\PHIL SCI. PASSERS 2006.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2006 HSETR-CETR\UPCAT PASSERS' 2006.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2007 HSETR-CETR\CETR QUIZZES 2007.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2007 HSETR-CETR\Dry run Results 2007.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2007 HSETR-CETR\HSETR QUIZZES.2007.PAM.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\2007 HSETR-CETR\Hsetr Record 2007.PAM.xls
C:\TEMP\Kai\Admin\CETR HSETR for T.BETH\DTR_315_ Sept. 28 to Oct.12.xls
C:\TEMP\Kai\Admin\CETR Results 2006\Alabang\MSA Alabang ACET DRY RUN 2006.xls
C:\TEMP\Kai\Admin\CETR Results 2006\Alabang\MSA Alabang Compre DRY RUN 2006.xls
C:\TEMP\Kai\Admin\CETR Results 2006\Alabang\MSA Alabang HSETR and Refresher Dry Run Results 2007.xlsx
C:\TEMP\Kai\Admin\CETR Results 2006\Alabang\MSA Alabang UPCAT Dry Run 2006.xls
C:\TEMP\Kai\Admin\CETR Results 2006\Cebu\CETR DRY RUN RESULT CEBU.doc
C:\TEMP\Kai\Admin\CETR Results 2006\Cebu\CETR STUDENTS of 2006.doc
C:\TEMP\Kai\Admin\CETR Results 2006\Cebu\hsetr STUDENTS of 2006 CEBU.doc
C:\TEMP\Kai\Admin\CETR Results 2006\Cebu\HSETR SUMMARY OF RESULT CEBU.doc
C:\TEMP\Kai\Admin\CETR Results 2006\Katipunan\CETR Dry run Result.doc
C:\TEMP\Kai\Admin\CETR Results 2006\Katipunan\CETR LIST OF STUDENT 2006 for KAI.xls
C:\TEMP\Kai\Admin\CETR Results 2006\Katipunan\CETR Ref[1]. Course.doc
C:\TEMP\Kai\Admin\CETR Results 2006\Katipunan\CETR Ref[1].Course UP ATENEO LASALLE UST.doc
C:\TEMP\Kai\Admin\CETR Results 2006\Katipunan\CETR refresher dryrun result(UST).doc
C:\TEMP\Kai\Admin\CETR Results 2006\Makati\CETR ( Dry-run, Quizzes, Diagnostic[1].xls) Makati.xls
C:\TEMP\Kai\Admin\CETR Results 2006\Makati\HSETR (2006 & 2007) Makati.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Alabang\ACET Refresher Dry Run Results 2007.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Alabang\CETR Compre Dry Run Results 2007.xlsx
C:\TEMP\Kai\Admin\CETR Results 2007\Alabang\La Salle Refresher Dry Run Results 2007.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Alabang\UPCAT Refresher Dry Run results 2007.xlsx
C:\TEMP\Kai\Admin\CETR Results 2007\Fairview\MSA FAIRVIEW CETR DRY RUN 2007.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\HSETR QUIZZES.2007.PAM.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\Hsetr Record 2007.PAM.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\REFRESHER '07\ACET Ref. 2007.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\REFRESHER '07\DLSU Ref. 2007.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\REFRESHER '07\dlsu,ust…exam date.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\REFRESHER '07\REFRESHER ATTENDANCE TEMPLATE.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\REFRESHER '07\UA&P Ref. 2007.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\REFRESHER '07\UPCAT Ref. 2007.xls
C:\TEMP\Kai\Admin\CETR Results 2007\Katipunan\REFRESHER '07\UST Ref. 2007.xls
C:\TEMP\Kai\Admin\CSE\6 - General Information relayout Explanation.pmd
C:\TEMP\Kai\Admin\CSE\cse-cyril.pmd
C:\TEMP\Kai\Admin\CSE\CSE diagnostic test.ppt
C:\TEMP\Kai\Admin\CSE\CSE Vol 1PPT\General Information CSE Vol 1.ppt
C:\TEMP\Kai\Admin\CSE\CSE Vol 1PPT\Language Proficiency CSE Vol 1.ppt
C:\TEMP\Kai\Admin\CSE\CSE Vol 1PPT\Logical Reasoning CSE Vol 1.ppt
C:\TEMP\Kai\Admin\CSE\CSE Vol 1PPT\Math CSE Vol 1.ppt
C:\TEMP\Kai\Admin\CSE\CSE Vol 1PPT\Thumbs.db
C:\TEMP\Kai\Admin\HSETR 2007\HSETR DRY RUN 2007.xls
C:\TEMP\Kai\Admin\LAE\Abstract.ppt
C:\TEMP\Kai\Admin\LAE\Critical Reasoning.ppt
C:\TEMP\Kai\Admin\LAE\LAE Schedule.doc
C:\TEMP\Kai\Admin\LAE\loren-lae diag beda.ppt
C:\TEMP\Kai\Admin\LAE\numerical.ppt
C:\TEMP\Kai\Admin\LAE\REGISTRATION for the LAE DIAGNOSTIC TEST.doc
C:\TEMP\Kai\Admin\NCAE II\clerical ability 2 final.pmd
C:\TEMP\Kai\Admin\NCAE II\interpersonal skills test.pmd
C:\TEMP\Kai\Admin\NCAE II\Logical Reasoning 2 final.pmd
C:\TEMP\Kai\Admin\NCAE II\numerical ability 2.pmd
C:\TEMP\Kai\Admin\NCAE II\science test 2 final.pmd
C:\TEMP\Kai\Admin\NCAE II\verbal ability 2 final.pmd
C:\TEMP\Kai\Admin\PAM.FILES\Daily Sales_315_ November ' 08.xls
C:\TEMP\Kai\Admin\PAM.FILES\DLSU UST Refresher.2007.xls
C:\TEMP\Kai\Admin\PAM.FILES\HSETR QUIZZES.2007.PAM.xls
C:\TEMP\Kai\Admin\PAM.FILES\Hsetr Record 2007.PAM.xls
C:\TEMP\Kai\Admin\PAM.FILES\REFRESHER '07\ACET Ref. 2007.xls
C:\TEMP\Kai\Admin\PAM.FILES\REFRESHER '07\DLSU Ref. 2007.xls
C:\TEMP\Kai\Admin\PAM.FILES\REFRESHER '07\dlsu,ust…exam date.xls
C:\TEMP\Kai\Admin\PAM.FILES\REFRESHER '07\REFRESHER ATTENDANCE TEMPLATE.xls
C:\TEMP\Kai\Admin\PAM.FILES\REFRESHER '07\UA&P Ref. 2007.xls
C:\TEMP\Kai\Admin\PAM.FILES\REFRESHER '07\UPCAT Ref. 2007.xls
C:\TEMP\Kai\Admin\PAM.FILES\REFRESHER '07\UST Ref. 2007.xls
C:\TEMP\Kai\Admin\Project Approach Training\project approach.doc
C:\TEMP\Kai\Admin\Project Approach Training\T[1].Thess' report (Project Approach).doc
C:\TEMP\Kai\Admin\SAT Practice Test Key.doc
C:\TEMP\Kai\Admin\Teachers Project\TKendychem2.doc
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 032.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 033.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 038.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 039.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 040.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 042.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 048.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 051.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 053.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 054.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 055.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 056.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 057.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 059.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 060.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 061.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 062.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 063.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 064.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 066.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 067.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 069.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 070.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 071.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 073.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 074.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 077.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 079.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 080.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 082.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 083.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Applied Scholastics Seminar 087.jpg
C:\TEMP\Kai\Applied Scholastics Seminar\Thumbs.db
C:\TEMP\Kai\KAI-KAI\2007 reports new.xls
C:\TEMP\Kai\KAI-KAI\2007 reports.xls
C:\TEMP\Kai\KAI-KAI\Analysis of Data year 2006.xls
C:\TEMP\Kai\KAI-KAI\Analysis of Data year AUG. - NOV 2006.xls
C:\TEMP\Kai\KAI-KAI\Analysis of Data year Jan. - June 2007.xls
C:\TEMP\Kai\KAI-KAI\Book1.xls
C:\TEMP\Kai\KAI-KAI\CAKE.pmd
C:\TEMP\Kai\KAI-KAI\CSE-CEBU.xls
C:\TEMP\Kai\KAI-KAI\CSE-KATIPUNAN.xls
C:\TEMP\Kai\KAI-KAI\NO. OF ENROLLEES.xls
C:\TEMP\Kai\KAI-KAI\Parent Guidelines.doc
C:\TEMP\Kai\KAI-KAI\PET DR SCHED.xls
C:\TEMP\Kai\KAI-KAI\Playschool Files\0129-0154 Phonics level 1 Alphabet with tracing.pmd
C:\TEMP\Kai\KAI-KAI\Playschool Files\0155-0180 Phonics level 1 Letter Sounds.pmd
C:\TEMP\Kai\KAI-KAI\Playschool Files\0181-0206 Phonics level 1 Alphabet Coloring.pmd
C:\TEMP\Kai\KAI-KAI\Playschool Files\0284-0314 Phonics level 2 Short vowel sounds reading.pmd
C:\TEMP\Kai\KAI-KAI\Playschool Files\0391-0451 Phonics level 3 blends and digraphs.pmd
C:\TEMP\Kai\KAI-KAI\Playschool Files\0452-0475 Phonics level 3 reading.pmd
C:\TEMP\Kai\KAI-KAI\Playschool Files\0476-0539 Phonics level 4 Long vowel sounds.pmd
C:\TEMP\Kai\KAI-KAI\Playschool Files\0540-0567 Phonics level 4 Long vowel sounds reading.pmd
C:\TEMP\Kai\KAI-KAI\State your top 3 most wanted Wishes.doc
C:\TEMP\Kai\KAI-KAI\student staff ratio.xls
C:\TEMP\Kai\kai\Copy of IMG_6167.JPG
C:\TEMP\Kai\kai\Copy of PICT0108.JPG
C:\TEMP\Kai\kai\IMG_5351.JPG
C:\TEMP\Kai\kai\IMG_5355.JPG
C:\TEMP\Kai\kai\IMG_5358.JPG
C:\TEMP\Kai\kai\IMG_5382.JPG
C:\TEMP\Kai\kai\IMG_5392.JPG
C:\TEMP\Kai\kai\IMG_5395.JPG
C:\TEMP\Kai\kai\IMG_5405.JPG
C:\TEMP\Kai\kai\IMG_5929.jpg
C:\TEMP\Kai\kai\IMG_5931.jpg
C:\TEMP\Kai\kai\IMG_5932.jpg
C:\TEMP\Kai\kai\IMG_5936.jpg
C:\TEMP\Kai\kai\IMG_5942.jpg
C:\TEMP\Kai\kai\IMG_5943.jpg
C:\TEMP\Kai\kai\IMG_5947.jpg
C:\TEMP\Kai\kai\IMG_5950.jpg
C:\TEMP\Kai\kai\IMG_5954.jpg
C:\TEMP\Kai\kai\IMG_5957.jpg
C:\TEMP\Kai\kai\IMG_5958.jpg
C:\TEMP\Kai\kai\IMG_6007.jpg
C:\TEMP\Kai\kai\IMG_6010.jpg
C:\TEMP\Kai\kai\IMG_6022.jpg
C:\TEMP\Kai\kai\IMG_6025.jpg
C:\TEMP\Kai\kai\IMG_6027.jpg
C:\TEMP\Kai\kai\IMG_6167.jpg
C:\TEMP\Kai\kai\PICT0025.jpg
C:\TEMP\Kai\kai\PICT0029.jpg
C:\TEMP\Kai\kai\PICT0031.jpg
C:\TEMP\Kai\kai\PICT0034.jpg
C:\TEMP\Kai\kai\PICT0108.jpg
C:\TEMP\Kai\kai\Picture 001.jpg
C:\TEMP\Kai\kai\Picture 002.jpg
C:\TEMP\Kai\kai\Picture 004.jpg
C:\TEMP\Kai\kai\Picture 005.jpg
C:\TEMP\Kai\kai\Picture 009.jpg
C:\TEMP\Kai\kai\Picture 017.jpg
C:\TEMP\Kai\kai\Picture 026.jpg
C:\TEMP\Kai\kai\Picture 027.jpg
C:\TEMP\Kai\kai\Picture 032.jpg
C:\TEMP\Kai\kai\Picture 035.jpg
C:\TEMP\Kai\kai\Picture 049.jpg
C:\TEMP\Kai\kai\Picture 058.jpg
C:\TEMP\Kai\kai\Picture 060.jpg
C:\TEMP\Kai\kai\Picture 061.jpg
C:\TEMP\Kai\kai\Picture 062.jpg
C:\TEMP\Kai\kai\Picture 063.jpg
C:\TEMP\Kai\kai\Picture 064.jpg
C:\TEMP\Kai\kai\Picture 065.jpg
C:\TEMP\Kai\kai\Picture 066.jpg
C:\TEMP\Kai\kai\Picture 067.jpg
C:\TEMP\Kai\kai\Picture 069.jpg
C:\TEMP\Kai\kai\Picture 072.jpg
C:\TEMP\Kai\kai\Picture 090.jpg
C:\TEMP\Kai\kai\Picture 091.jpg
C:\TEMP\Kai\kai\Picture 092.jpg
C:\TEMP\Kai\kai\Picture 093.jpg
C:\TEMP\Kai\kai\Picture 094.jpg
C:\TEMP\Kai\kai\Picture 095.jpg
C:\TEMP\Kai\kai\Picture 099.jpg
C:\TEMP\Kai\kai\Picture 100.jpg
C:\TEMP\Kai\kai\Picture 101.jpg
C:\TEMP\Kai\kai\Picture 102.jpg
C:\TEMP\Kai\kai\Picture 105.jpg
C:\TEMP\Kai\kai\Picture 160.jpg
C:\TEMP\Kai\kai\Picture 162.jpg
C:\TEMP\Kai\kai\Shortcut to IMG_5958.jpg.lnk
C:\TEMP\Kai\kai\Thumbs.db
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 020.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 021.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 022.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 023.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 024.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 026.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 027.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 028.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 029.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 030.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 031.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 032.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 033.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 034.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 035.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 036.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 037.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 038.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 039.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 040.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 041.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 042.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 043.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 044.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 045.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 046.jpg
C:\TEMP\Kai\MSA Whiz Kids\MSA Whiz Kids 047.jpg
C:\TEMP\MORESNDS
C:\TEMP\MORESNDS\16BIT\12GAUGE.WAV
C:\TEMP\MORESNDS\16BIT\357MAG.WAV
C:\TEMP\MORESNDS\16BIT\44MAG.WAV
C:\TEMP\MORESNDS\16BIT\ABOARD.WAV
C:\TEMP\MORESNDS\16BIT\ADDING1.WAV
C:\TEMP\MORESNDS\16BIT\AGOGO.WAV
C:\TEMP\MORESNDS\16BIT\AIRRAID.WAV
C:\TEMP\MORESNDS\16BIT\ALIEN.WAV
C:\TEMP\MORESNDS\16BIT\ATOMIC.WAV
C:\TEMP\MORESNDS\16BIT\AWARGLIS.WAV
C:\TEMP\MORESNDS\16BIT\AZIPGLIS.WAV
C:\TEMP\MORESNDS\16BIT\BABYJAG.WAV
C:\TEMP\MORESNDS\16BIT\BCRASH.WAV
C:\TEMP\MORESNDS\16BIT\BESSIE.WAV
C:\TEMP\MORESNDS\16BIT\BIGHORN.WAV
C:\TEMP\MORESNDS\16BIT\BIGSKID.WAV
C:\TEMP\MORESNDS\16BIT\BIPLANE.WAV
C:\TEMP\MORESNDS\16BIT\BLAKBIRD.WAV
C:\TEMP\MORESNDS\16BIT\BLAST1.WAV
C:\TEMP\MORESNDS\16BIT\BLAST2.WAV
C:\TEMP\MORESNDS\16BIT\BLDGFIRE.WAV
C:\TEMP\MORESNDS\16BIT\BOATSTRT.WAV
C:\TEMP\MORESNDS\16BIT\BONKSRAZ.WAV
C:\TEMP\MORESNDS\16BIT\BONKWHRL.WAV
C:\TEMP\MORESNDS\16BIT\BROWNING.WAV
C:\TEMP\MORESNDS\16BIT\BULL.WAV
C:\TEMP\MORESNDS\16BIT\BURGLAR.WAV
C:\TEMP\MORESNDS\16BIT\CALVARY.WAV
C:\TEMP\MORESNDS\16BIT\CAMEL1.WAV
C:\TEMP\MORESNDS\16BIT\CARRIER1.WAV
C:\TEMP\MORESNDS\16BIT\CARRIER2.WAV
C:\TEMP\MORESNDS\16BIT\CARRIER3.WAV
C:\TEMP\MORESNDS\16BIT\CASH1.WAV
C:\TEMP\MORESNDS\16BIT\CASH2.WAV
C:\TEMP\MORESNDS\16BIT\CATMEOW.WAV
C:\TEMP\MORESNDS\16BIT\CESSNA.WAV
C:\TEMP\MORESNDS\16BIT\CHAINSAW.WAV
C:\TEMP\MORESNDS\16BIT\CHICK.WAV
C:\TEMP\MORESNDS\16BIT\CHOIR2.WAV
C:\TEMP\MORESNDS\16BIT\CHOPPER1.WAV
C:\TEMP\MORESNDS\16BIT\CHOPPER2.WAV
C:\TEMP\MORESNDS\16BIT\CHORAL2.WAV
C:\TEMP\MORESNDS\16BIT\COFFEE.WAV
C:\TEMP\MORESNDS\16BIT\COMICD.WAV
C:\TEMP\MORESNDS\16BIT\COUNTER.WAV
C:\TEMP\MORESNDS\16BIT\COWBOY.WAV
C:\TEMP\MORESNDS\16BIT\CREAROAR.WAV
C:\TEMP\MORESNDS\16BIT\CUCKOO01.WAV
C:\TEMP\MORESNDS\16BIT\DEMBONES.WAV
C:\TEMP\MORESNDS\16BIT\DIESEL.WAV
C:\TEMP\MORESNDS\16BIT\DISHELP.WAV
C:\TEMP\MORESNDS\16BIT\DOGBARK.WAV
C:\TEMP\MORESNDS\16BIT\DONKEY.WAV
C:\TEMP\MORESNDS\16BIT\DRAMA1.WAV
C:\TEMP\MORESNDS\16BIT\DRAMA2.WAV
C:\TEMP\MORESNDS\16BIT\DUCKS.WAV
C:\TEMP\MORESNDS\16BIT\EAGLE.WAV
C:\TEMP\MORESNDS\16BIT\ELEPHNT1.WAV
C:\TEMP\MORESNDS\16BIT\ENTITY.WAV
C:\TEMP\MORESNDS\16BIT\EUROPOL.WAV
C:\TEMP\MORESNDS\16BIT\FALLIN.WAV
C:\TEMP\MORESNDS\16BIT\FALLSTRS.WAV
C:\TEMP\MORESNDS\16BIT\FALLYELL.WAV
C:\TEMP\MORESNDS\16BIT\FANFLUTE.WAV
C:\TEMP\MORESNDS\16BIT\FERSURE.WAV
C:\TEMP\MORESNDS\16BIT\FIELD.WAV
C:\TEMP\MORESNDS\16BIT\FIRSTCAL.WAV
C:\TEMP\MORESNDS\16BIT\FORE.WAV
C:\TEMP\MORESNDS\16BIT\FULLFAN2.WAV
C:\TEMP\MORESNDS\16BIT\GAMESHOW.WAV
C:\TEMP\MORESNDS\16BIT\GARGLE.WAV
C:\TEMP\MORESNDS\16BIT\GHOST.WAV
C:\TEMP\MORESNDS\16BIT\GRINDER.WAV
C:\TEMP\MORESNDS\16BIT\HARP1.WAV
C:\TEMP\MORESNDS\16BIT\HARPGLIS.WAV
C:\TEMP\MORESNDS\16BIT\HEADSHAK.WAV
C:\TEMP\MORESNDS\16BIT\HELP.WAV
C:\TEMP\MORESNDS\16BIT\HICCUP.WAV
C:\TEMP\MORESNDS\16BIT\HORGAN.WAV
C:\TEMP\MORESNDS\16BIT\HORRORBL.WAV
C:\TEMP\MORESNDS\16BIT\HORSE1.WAV
C:\TEMP\MORESNDS\16BIT\HSTINGER.WAV
C:\TEMP\MORESNDS\16BIT\HUH.WAV
C:\TEMP\MORESNDS\16BIT\KAZOO.WAV
C:\TEMP\MORESNDS\16BIT\LARGEGAS.WAV
C:\TEMP\MORESNDS\16BIT\LASER2.WAV
C:\TEMP\MORESNDS\16BIT\LEAR.WAV
C:\TEMP\MORESNDS\16BIT\LEXPLODE.WAV
C:\TEMP\MORESNDS\16BIT\MACSTART.WAV
C:\TEMP\MORESNDS\16BIT\MARSH1.WAV
C:\TEMP\MORESNDS\16BIT\MARSH2.WAV
C:\TEMP\MORESNDS\16BIT\MEDBING.WAV
C:\TEMP\MORESNDS\16BIT\MEDIEVA1.WAV
C:\TEMP\MORESNDS\16BIT\MONKEY.WAV
C:\TEMP\MORESNDS\16BIT\MUSFALL.WAV
C:\TEMP\MORESNDS\16BIT\NEEDLE.WAV
C:\TEMP\MORESNDS\16BIT\OFF.WAV
C:\TEMP\MORESNDS\16BIT\OH.WAV
C:\TEMP\MORESNDS\16BIT\OHNO.WAV
C:\TEMP\MORESNDS\16BIT\ONERING.WAV
C:\TEMP\MORESNDS\16BIT\OOOOOOH.WAV
C:\TEMP\MORESNDS\16BIT\ORGBRID2.WAV
C:\TEMP\MORESNDS\16BIT\OUCH.WAV
C:\TEMP\MORESNDS\16BIT\OUT.WAV
C:\TEMP\MORESNDS\16BIT\OWL.WAV
C:\TEMP\MORESNDS\16BIT\PAINYELL.WAV
C:\TEMP\MORESNDS\16BIT\PENCIL.WAV
C:\TEMP\MORESNDS\16BIT\PIANOBRG.WAV
C:\TEMP\MORESNDS\16BIT\PIGVOCAL.WAV
C:\TEMP\MORESNDS\16BIT\PLANE.WAV
C:\TEMP\MORESNDS\16BIT\PLAYBALL.WAV
C:\TEMP\MORESNDS\16BIT\POMERANI.WAV
C:\TEMP\MORESNDS\16BIT\RATTLER.WAV
C:\TEMP\MORESNDS\16BIT\REVEILLE.WAV
C:\TEMP\MORESNDS\16BIT\ROBOTS.WAV
C:\TEMP\MORESNDS\16BIT\ROOSTER.WAV
C:\TEMP\MORESNDS\16BIT\RSTAB1.WAV
C:\TEMP\MORESNDS\16BIT\RUNDRUMS.WAV
C:\TEMP\MORESNDS\16BIT\SBOINGMD.WAV
C:\TEMP\MORESNDS\16BIT\SCREAM.WAV
C:\TEMP\MORESNDS\16BIT\SEAGULLS.WAV
C:\TEMP\MORESNDS\16BIT\SEALION.WAV
C:\TEMP\MORESNDS\16BIT\SHEEP1.WAV
C:\TEMP\MORESNDS\16BIT\SLOTPAY.WAV
C:\TEMP\MORESNDS\16BIT\SNARE.WAV
C:\TEMP\MORESNDS\16BIT\SNEEZE.WAV
C:\TEMP\MORESNDS\16BIT\SOSURE.WAV
C:\TEMP\MORESNDS\16BIT\SOUTHAM.WAV
C:\TEMP\MORESNDS\16BIT\SPCLIFT.WAV
C:\TEMP\MORESNDS\16BIT\SPRONG2.WAV
C:\TEMP\MORESNDS\16BIT\SPUTTER2.WAV
C:\TEMP\MORESNDS\16BIT\STRIKE.WAV
C:\TEMP\MORESNDS\16BIT\SUSPENS2.WAV
C:\TEMP\MORESNDS\16BIT\TAKEOFF.WAV
C:\TEMP\MORESNDS\16BIT\TAXIF.WAV
C:\TEMP\MORESNDS\16BIT\TESTJET.WAV
C:\TEMP\MORESNDS\16BIT\TIRESQL.WAV
C:\TEMP\MORESNDS\16BIT\TOILET1.WAV
C:\TEMP\MORESNDS\16BIT\TRASH.WAV
C:\TEMP\MORESNDS\16BIT\TREX.WAV
C:\TEMP\MORESNDS\16BIT\TRUKHORN.WAV
C:\TEMP\MORESNDS\16BIT\TURKEY.WAV
C:\TEMP\MORESNDS\16BIT\URINAL.WAV
C:\TEMP\MORESNDS\16BIT\WLAUGH.WAV
C:\TEMP\MORESNDS\16BIT\YAHOO.WAV
C:\TEMP\MORESNDS\16BIT\YAHOOC.WAV
C:\TEMP\MORESNDS\16BIT\YEEHAW.WAV
C:\TEMP\MORESNDS\16BIT\YEEHAW1.WAV
C:\TEMP\MORESNDS\16BIT\YIPPEE.WAV
C:\TEMP\MORESNDS\16BIT\YOW.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\BLAKBIRD.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\BLUEJAY1.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\BLUEJAY2.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\EAGLE.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\GOOSE.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\HAWK.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\LARK.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\OWL.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\PARROT.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\PIGEON.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\PRETTY.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\QUAIL.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\ROBIN.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\ROOSTER.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\BIRDS\SEAGULLS.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\BABYJAG.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\CATGROWL.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\CATHISS.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\CATMEOW.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\JAGUARS.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\LEOPARD.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\LIONMOAN.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\LIONS.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\LIONSNRL.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\ONELION.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\CATS\WILDCAT.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\DOGS\DOGPANTS.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\DOGS\DOGWHINE.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\DOGS\MIXBREED.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\DOGS\POMERANI.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\DOGS\TERRIER.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\DOGS\WOLVES1.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\DOGS\WOLVES2.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\FARM\DONKEY.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\FARM\PIGPEN.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\FARM\PIGSNORT.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\FARM\PIGVOCAL.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\FARM\SHEEP1.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\FARM\SHEEP2.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\FARM\TURKEY.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\HORSES\GALLOP.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\HORSES\HORSE1.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\HORSES\HORSE2.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\HORSES\HORSTROT.WAV
C:\TEMP\MORESNDS\8BIT\ANIMALS\HORSES\HORSWALK.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\CRASHES\AUTOROLL.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\CRASHES\EXPLODES.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\CRASHES\SKID.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\CRASHES\TIRESPIN.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\CRASHES\WINDOW.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\CRASHES\WINDSHLD.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\GENERAL\DOORLOCK.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\GENERAL\HOOD.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\GENERAL\MUSTCLOS.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\GENERAL\MUSTOPEN.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\GENERAL\MUSTSTRT.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\GENERAL\PARKBRAK.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\GENERAL\TRUNK.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\RACES\BURNOUT.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\RACES\DRAGSTER.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\RACES\INDY.WAV
C:\TEMP\MORESNDS\8BIT\AUTOS\RACES\VINTAGE.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\BIPLANE.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\CESSNA.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\CHOPPER1.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\CHOPPER2.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\CHOPPER3.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\LEAR.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\TAKEOFF.WAV
C:\TEMP\MORESNDS\8BIT\AVIATION\TESTJET.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\BOWTHWNG.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\DOING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\DULBOING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\ELCBONG.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\HAMMER.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\HIBONG.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\HIGHBING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\IMPACT.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\JEWSHARP.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\LOWBING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\MEDBING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\MTLBONG.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\PBOING1.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\PBOING2.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\POING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\RAZBOING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SBOINGHI.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SBOINGLO.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SBOINGMD.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SMLGONG.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SPCBOUNC.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SPRONG1.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SPRONG2.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SPRONG3.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SPUTTER1.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\SPUTTER2.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\TOONBONK.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\VOCBING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\WARBLE.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\BOINGS\WARBSHT.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\BOATHORN.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\CORKPOP.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\CSPLAT.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\FOGHORN.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\HORRORBL.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\LGBUBBLE.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\MUSFALL.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\POOF.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\RATCHET.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\SCREW.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\SQUISH.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\WASHBORD.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\WETHUD.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\WHIRLING.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\CARTOON\ZIPPOP.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\PHONES\COINRTN.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\PHONES\EPHONE.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\PHONES\HANGUP.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\PHONES\INSCOIN1.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\PHONES\RMVCOIN.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\TOOLS\PDRILL.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\TOOLS\STEAM.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\TOOLS\THREAD.WAV
C:\TEMP\MORESNDS\8BIT\BEEPS\TOOLS\TOOLBELT.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\ABONKGLS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\AWARGLIS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\AZIPGLIS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\BONGPOPS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\BONGSPOP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\BONKSPOP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\BONKSRAZ.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\BONKSZIP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\BONKWHRL.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\BPHORN.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\CCRASH.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\CLANKG.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\CLANKW.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\CTNCLOCK.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\DBONKGLS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\DRMCLANK.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\DWARGLIS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\DZIPGLIS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\POTSPANS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\RUMMAGE.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\RUNDRUMS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\SLIDEDN.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\SMACK.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\SPIT1.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\TAKEWIFE.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\WHIZPOP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\WHSTDRUM.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\XYLOHEAD.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\ZINGZING.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\ZIPBONKS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\ZIPHORN.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\ACCENTS\ZIPRAZZ.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\CHICCUP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\CSNEEZE.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\FCOUGH.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\FSNEEZE1.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\FSNEEZE2.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\FYAWN.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\GEZUNT.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\KNUCKLES.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\MALEHEAD.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\MCOUGH1.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\MCOUGH2.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\MGARGLE.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\MHICCUP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\NOSE1.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\ONESPIT.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\SMACK1.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\SMACK2.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\HUMAN\SPURSTEP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\COWBOY.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\DISHELP.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\FALLSTRS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\FALLYELL.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\GHOST.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\HEADSHAK.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\OH.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\OOOOOOH.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\OOPS.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\OUCH.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\PAINYELL.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\YAHOO.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\YAHOOC.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\YEEHAW1.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\YIPPEE.WAV
C:\TEMP\MORESNDS\8BIT\CARTOON\YELLS\YOW.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\ANTSLOT.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\BACKGAMN.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\BACKROLL.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\COUNTER.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\FORTUNE.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\SHAKE1.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\SHAKE2.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\SHAKE3.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\SHUFCHIP.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\SLOTPAY.WAV
C:\TEMP\MORESNDS\8BIT\CASINO\TOSSCHIP.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\DIESEL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\HOTROD.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\JPNSDOOR.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\JPNSHORN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\MACHORN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\PORSDOOR.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\PORSHORN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\PORSSTRT.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\AUTOS\TRUKHORN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\BOXING.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\DESKBELL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\GAMESHOW.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\HIGHPTCH.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\LBRASBEL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\MEDPITCH.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\SBRASBEL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BELLS\XRAY.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\BINGO.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\GEIGER.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\GLOVEOFF.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\GLOVEON.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\ICECHOP.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\LAUNDRY.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\LOCKER.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\SHARPNER.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\SOFTDRNK.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\STMWHSTL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\WTHRDRY.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\BUSINESS\WTHRWET.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\CELLULAR\CELLDIAL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\CELLULAR\CELLRING.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\CELLULAR\PHONEON.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\CYCLES\HARAWAY.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\CYCLES\HOG.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\CYCLES\MOTORACE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\CYCLES\SUZHORN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\FIREBALL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\GLASSEXP.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\GLCRASH.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\HVYMETAL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\LARGEMET.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\METALCLG.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\METALPC.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\SPARK.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\EXPLODE\VARIOUS.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\AUTOLITE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\AUTOSKD.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\AUTOWIND.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\BIGSKID.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\BODYPNL1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\BODYPNL2.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\CRATE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\DEMOLISH.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\LGESKID.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\REVSQL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FENDER\TIRESQL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\BREATHE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\FIREEXT.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\FTRUCK1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\FTRUCK2.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\FTRUCK3.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\LIGHTER1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\LIGHTER2.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FIRES\MATCH.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FUN\ARCADE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FUN\ARCHERY.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FUN\COASTER.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FUN\LOTTERY.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\FUN\SQUASH.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GAS\GARAGE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GAS\GAS1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GAS\GAS2.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GAS\GASSLOSH.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GUNS\12GUAGEC.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GUNS\22CALIBR.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GUNS\38CALIBR.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GUNS\45CALSMG.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\GUNS\AK47.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\ALRMOFF.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\ALRMRING.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\BLDGFIRE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\BURGLAR.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\EUROPOL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\GAVEL1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\GAVEL2.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\GAVEL3.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\GUNCOCK.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\JAIL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\POLWHSTL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\PRADIO1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\PRADIO2.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\SILENCER.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\LAW\TWOTONE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\MONEY\MANYCOIN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\MONEY\ONECOIN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\MONEY\SACKCOIN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\AIRHORN1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\ANTACID.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\BULBHORN.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\CAMERA1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\DRAWBRID.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\SCREECH1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\SCREECH2.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\OTHER\SMLMOTOR.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\PUBLIC\ABOARD.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\PUBLIC\CITYBUS.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\PUBLIC\TAXIF.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\CATAPULT.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\CHISEL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\FILLTIRE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\GRANDCTL.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\GRITTY.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\LIDCLOSE.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\WRENCH1.WAV
C:\TEMP\MORESNDS\8BIT\CITYLIFE\STREET\WRENCH2.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\ALARMS\AIRRAID.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\ALARMS\CARRIER1.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\ALARMS\CARRIER2.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\ALARMS\CARRIER3.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\EXPLODE\ATOMIC.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\EXPLODE\BLAST1.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\EXPLODE\BLAST2.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\EXPLODE\LARGEGAS.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\EXPLODE\LEXPLODE.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\38REVOLV.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\ANTITNK1.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\ANTITNK2.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\BAYONET.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\CANNON1.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\CANNON2.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\FLAME.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\HOWITZER.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\M16.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\MP5.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\SWORDSCP.WAV
C:\TEMP\MORESNDS\8BIT\COMBAT\WEAPONS\TANK.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\CHANTS\ENCORE.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\CHANTS\FREEDOM.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\CHANTS\GO.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\CHANTS\GOTEAM1.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\CHANTS\GOTEAM2.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\CHANTS\HELLNO.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\CHANTS\MORE.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\VOCALS\AAAAH.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\VOCALS\BOO.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\VOCALS\BRAVO.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\VOCALS\CHEER1.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\VOCALS\CHEER2.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\VOCALS\NITECLUB.WAV
C:\TEMP\MORESNDS\8BIT\CROWDS\VOCALS\WOW.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\AIR.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\AMRADIO.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\ANSMACH.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\DIRT1.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\DIRT2.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\FAN.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\FURNACE.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\HANDDRY.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\HANDMIX.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\PROJECTO.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\SCREEN.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\SPRAY.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\THEATER.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\VAC.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\WASHCLOS.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\WASHWASH.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\APPLIANC\WASHWATR.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\BATHROOM\CURTAIN.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\BATHROOM\HAIRDRY.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\BATHROOM\PLUNGER.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\BATHROOM\SHAVE.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\BATHROOM\SHOWER.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\BATHROOM\TOILET1.WAV
C:\TEMP\MORESNDS\8BIT\HOUSE\BATHROOM\URINAL.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BABIES\BBYSCRM.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BABIES\COOING.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BADHABIT\LGEBURP.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BADHABIT\LOTSWIND.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BADHABIT\MEDBURP.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BADHABIT\MODWIND.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BADHABIT\NECK.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BADHABIT\SMLBURP.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BADHABIT\VOMIT.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BREATHE\BLOWUP.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BREATHE\CCOUGH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BREATHE\FCOUGH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BREATHE\HEAVY.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\BREATHE\MBREATH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\HURTME\ARMSWING.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\HURTME\CRACK.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\HURTME\IMPACT.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\HURTME\PUNCFACE.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\HURTME\SLAPFACE.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\LAUGHS\BBYSNZ.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\LAUGHS\CHIPLAFF.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\LAUGHS\COMIC1.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\LAUGHS\COMIC2.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\LAUGHS\HILARIOU.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\LAUGHS\MALEHARD.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\LAUGHS\SNORTY.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\ATTACK.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\DENTIST.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\DRTEETH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\FLATLINE.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\HEARTMON.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\POLISH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\SPRAY.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\MEDICAL\SUCTION.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\CELERY.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\GARBLED.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\GRUNT.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\HEART1.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\HEART2.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\HEART3.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\MALENOSE.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\OTHER\MTHROAT.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\VOCALS\FMLSCRM.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\VOCALS\HUH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\VOCALS\NO.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\VOCALS\OHNO.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\VOCALS\SHHH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\VOCALS\SIGH.WAV
C:\TEMP\MORESNDS\8BIT\HUMAN\VOCALS\WHAT.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\DRAMA1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\DRAMA2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\HORGAN.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\HSTINGER.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\MYSTERY.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\SBRIDGE.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\SUSPENS1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\SUSPENS2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\SUSPENS3.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\DRAMA\SUSPENS4.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\ETHNIC\APACHE.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\ETHNIC\BRIDE.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\ETHNIC\LATIN.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\BASSDRUM.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\BDRS.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\BONGOS1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\BONGOS2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\BRIDGE.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\CONCBASS.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\CONGA.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\DCOMEDY.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\DRUMACNT.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\HIHAT2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\MARCHINT.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\MARIMBA.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\MBRIDGE1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\MBRIDGE2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\MBRIDGE3.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\SHORTD.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\TIMPANI1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PERCUSSN\TIMPANI2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\CHOIR1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\CHOIR2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\JAZZBRID.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\ORGBRID1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\ORGBRID2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\PIANOBRG.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\PIANOTG1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\PIANOS\PIANOTG2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\ROCK\BENDDOWN.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\ROCK\RSTAB1.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\ROCK\RSTAB2.WAV
C:\TEMP\MORESNDS\8BIT\MUSIC\ROCK\RSTAB3.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\COMPUTER\BLIP.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\COMPUTER\BLURP.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\COMPUTER\KEYBOARD.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\COMPUTER\MACSTART.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\COMPUTER\MONITOR.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\COMPUTER\PCBEEP.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\DESK\STAPLER.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\DESK\TAPE.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\BRIEF1.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\BRIEF2.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\DESKCLOS.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\EPHONE.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\FAXSEND.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\FREIGHT.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\SCREECHY.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\STORCLOS.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\EQUIP\STOROPEN.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\MONEY\ADDING1.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\MONEY\ADDING2.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\MONEY\CASH1.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\MONEY\CASH2.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\MONEY\IMPRINT1.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\MONEY\IMPRINT2.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\MONEY\TEARPPR.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\PAPER\PAD.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\PAPER\PAPERCUT.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\PAPER\PENCIL.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\PAPER\PPRPUNCH.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\PAPER\WRITING.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\TYPE\CARRIAGE.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\TYPE\ENDLINE.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\TYPE\REMOVE.WAV
C:\TEMP\MORESNDS\8BIT\OFFICE\TYPE\TYPERROR.WAV
C:\TEMP\SOUNDS
C:\TEMP\SOUNDS\ABOARD.WAV
C:\TEMP\SOUNDS\AWARGLIS.WAV
C:\TEMP\SOUNDS\AZIPGLIS.WAV
C:\TEMP\SOUNDS\BCRASH.WAV
C:\TEMP\SOUNDS\BESSIE.WAV
C:\TEMP\SOUNDS\BIGHORN.WAV
C:\TEMP\SOUNDS\BIGSKID.WAV
C:\TEMP\SOUNDS\CASH2.WAV
C:\TEMP\SOUNDS\CHICK.WAV
C:\TEMP\SOUNDS\COMICD.WAV
C:\TEMP\SOUNDS\CREAROAR.WAV
C:\TEMP\SOUNDS\CUCKOO01.WAV
C:\TEMP\SOUNDS\DIESEL.WAV
C:\TEMP\SOUNDS\DOGBARK.WAV
C:\TEMP\SOUNDS\DONKEY.WAV
C:\TEMP\SOUNDS\FERSURE.WAV
C:\TEMP\SOUNDS\GAMESHOW.WAV
C:\TEMP\SOUNDS\GARGLE.WAV
C:\TEMP\SOUNDS\HEADSHAK.WAV
C:\TEMP\SOUNDS\HELP.WAV
C:\TEMP\SOUNDS\HICCUP.WAV
C:\TEMP\SOUNDS\HORRORBL.WAV
C:\TEMP\SOUNDS\HORSE1.WAV
C:\TEMP\SOUNDS\HSTINGER.WAV
C:\TEMP\SOUNDS\HUH.WAV
C:\TEMP\SOUNDS\KAZOO.WAV
C:\TEMP\SOUNDS\LASER2.WAV
C:\TEMP\SOUNDS\LEAR.WAV
C:\TEMP\SOUNDS\MUSFALL.WAV
C:\TEMP\SOUNDS\OHNO.WAV
C:\TEMP\SOUNDS\ONERING.WAV
C:\TEMP\SOUNDS\OUCH.WAV
C:\TEMP\SOUNDS\OWL.WAV
C:\TEMP\SOUNDS\RATTLER.WAV
C:\TEMP\SOUNDS\ROOSTER.WAV
C:\TEMP\SOUNDS\RSTAB1.WAV
C:\TEMP\SOUNDS\SCREAM.WAV
C:\TEMP\SOUNDS\SEALION.WAV
C:\TEMP\SOUNDS\SHEEP1.WAV
C:\TEMP\SOUNDS\SNARE.WAV
C:\TEMP\SOUNDS\SNEEZE.WAV
C:\TEMP\SOUNDS\SOSURE.WAV
C:\TEMP\SOUNDS\TAXIF.WAV
C:\TEMP\SOUNDS\TRASH.WAV
C:\TEMP\SOUNDS\TREX.WAV
C:\TEMP\SOUNDS\TRUKHORN.WAV
C:\TEMP\SOUNDS\TURKEY.WAV
C:\TEMP\SOUNDS\WLAUGH.WAV
C:\TEMP\SOUNDS\YEEHAW.WAV
C:\TEMP\SOUNDS\YEEHAW1.WAV
C:\TEMP\VID_ANIM
C:\TEMP\VID_ANIM\ANIM\0015MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0023MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0034MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0042MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0050MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0055MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0061MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0083MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0105MOV.AVI
C:\TEMP\VID_ANIM\ANIM\0204MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\0184MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\0908MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\1013MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\1056MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\1067MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\1100MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\1317MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\1918MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\6191MOV.AVI
C:\TEMP\VID_ANIM\VIDEOS\6237MOV.AVI

.
((((((((((((((((((((((((( Files Created from 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))
.

2008-02-19 14:59 . 2008-02-19 14:59 18,347,008 –a—— C:\Windows\System32\imageres.dll
2008-02-19 08:53 . 2008-01-10 13:50 1,244,672 –a—— C:\Windows\System32\mcmde.dll
2008-02-15 11:28 . 2008-02-15 11:28 d——– C:\Program Files\Trend Micro
2008-02-15 08:51 . 2008-02-15 08:51 d——– C:\VundoFix Backups
2008-02-15 08:29 . 2008-02-15 08:29 194,560 –a—— C:\Windows\System32\WebClnt.dll
2008-02-15 08:29 . 2008-02-15 08:29 110,080 –a—— C:\Windows\System32\drivers\mrxdav.sys
2008-02-15 08:19 . 2008-02-15 08:19 3,504,696 –a—— C:\Windows\System32\ntkrnlpa.exe
2008-02-15 08:18 . 2008-02-15 08:18 4,247,552 –a—— C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-15 08:18 . 2008-02-15 08:18 1,686,528 –a—— C:\Windows\System32\gameux.dll
2008-02-15 08:17 . 2008-02-15 08:17 d——– C:\Windows\Internet Logs
2008-02-14 16:52 . 2008-02-14 17:05 d——– C:\Users\All Users\Spybot - Search & Destroy
2008-02-14 16:52 . 2008-02-14 17:05 d——– C:\ProgramData\Spybot - Search & Destroy
2008-02-14 16:52 . 2008-02-14 16:52 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-14 16:20 . 2008-02-14 16:22 d——– C:\HijackThis
2008-02-14 11:12 . 2007-10-18 08:51 172,032 –a—— C:\Windows\System32\igfxres.dll
2008-02-14 10:17 . 2008-02-14 10:17 d——– C:\TEMP\Adobe InDesign CS2
2008-02-10 23:39 . 2008-02-10 23:48 d——– C:\Program Files\Immortal Defense
2008-02-09 12:12 . 2008-02-09 16:46 d——– C:\Disk Images
2008-02-04 14:41 . 2008-02-04 14:59 d——– C:\Users\MasterRaven\AppData\Roaming\FontCreator
2008-02-04 14:41 . 2008-02-04 14:41 d——– C:\Program Files\High-Logic
2008-02-04 13:32 . 2008-02-04 13:32 d——– C:\Windows\PrimoPDF
2008-02-04 13:32 . 2008-02-04 13:32 d——– C:\Program Files\activePDF
2008-02-04 13:32 . 2006-12-12 04:12 176,235 –a—— C:\Windows\System32\Primomonnt.dll
2008-02-01 11:59 . 2008-01-12 18:32 23,904 –a—— C:\Windows\System32\drivers\COH_Mon.sys
2008-02-01 11:59 . 2008-01-15 09:54 10,537 –a—— C:\Windows\System32\drivers\COH_Mon.cat
2008-02-01 11:59 . 2008-01-15 05:28 706 –a—— C:\Windows\System32\drivers\COH_Mon.inf
2008-01-31 10:01 . 2008-01-31 10:01 d——– C:\Users\MasterRaven\.pcgen
2008-01-31 10:00 . 2008-01-31 10:00 d——– C:\Program Files\OpenRPG
2008-01-31 09:56 . 2008-01-31 09:57 d——– C:\Program Files\PCGen
2008-01-31 09:55 . 2008-01-31 09:58 d——– C:\Python25
2008-01-31 09:15 . 2008-01-31 09:15 d——– C:\Program Files\Redblade 3.5e
2008-01-30 10:27 . 2008-01-30 10:27 d——– C:\Windows\System32\Kaspersky Lab
2008-01-30 10:27 . 2008-01-30 10:27 d——– C:\Users\All Users\Kaspersky Lab
2008-01-30 10:27 . 2008-01-30 10:27 d——– C:\ProgramData\Kaspersky Lab
2008-01-28 18:19 . 2008-02-14 13:55 d——– C:\Users\MasterRaven\AppData\Roaming\OpenOffice.org2
2008-01-28 18:16 . 2008-01-28 18:17 d——– C:\Program Files\OpenOffice.org 2.3
2008-01-21 13:33 . 2008-01-22 23:05 43 –a—— C:\Windows\SCNDRVU.INI
2008-01-21 13:32 . 1996-11-05 16:13 299,008 –a—— C:\Windows\uninst.exe
2008-01-21 13:32 . 1995-09-15 10:51 69,632 –a—— C:\Windows\TWUNK_32.728

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 03:52 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\Free Download Manager
2008-02-15 00:27 ——— d—–w C:\ProgramData\Symantec
2008-02-15 00:27 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-02-15 00:19 803,328 —-a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-15 00:15 824,832 —-a-w C:\Windows\System32\wininet.dll
2008-02-15 00:15 56,320 —-a-w C:\Windows\System32\iesetup.dll
2008-02-15 00:15 52,736 —-a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-15 00:15 26,624 —-a-w C:\Windows\System32\ieUnatt.exe
2008-02-14 02:21 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-03 02:05 ——— d—–w C:\Program Files\MyPhoneExplorer
2008-02-01 08:15 ——— d—–w C:\Program Files\Norton Internet Security
2008-01-23 23:48 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\Notepad++
2008-01-13 14:53 ——— d—–w C:\Program Files\Java
2008-01-13 14:49 ——— d—–w C:\Program Files\Common Files\Java
2008-01-13 00:36 ——— d—–w C:\ProgramData\Microsoft Help
2008-01-13 00:36 ——— d—–w C:\Program Files\Microsoft Works
2008-01-11 04:26 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\MyPhoneExplorer
2008-01-10 00:16 ——— d—–w C:\Program Files\Windows Mail
2008-01-09 12:36 211,000 —-a-w C:\Windows\system32\drivers\volsnap.sys
2008-01-09 12:36 11,776 —-a-w C:\Windows\System32\sbunattend.exe
2008-01-09 12:36 1,060,920 —-a-w C:\Windows\system32\drivers\ntfs.sys
2008-01-09 12:36 ——— d—–w C:\Program Files\Windows Sidebar
2008-01-07 10:04 ——— d—–w C:\Program Files\SyncToy 2.0 Beta
2008-01-07 10:03 ——— d—–w C:\Program Files\Microsoft SQL Server Compact Edition
2008-01-07 01:32 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\acer
2008-01-06 05:34 ——— d—–w C:\Program Files\yWriter4
2008-01-06 03:48 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\CyberLink
2008-01-05 03:09 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-01-05 03:08 ——— d—–w C:\Program Files\Microsoft SQL Server
2008-01-05 03:05 ——— d—–w C:\Program Files\Microsoft.NET
2008-01-05 02:32 ——— d—–w C:\Program Files\Microsoft Visual Studio 9.0
2008-01-05 02:31 ——— d—–w C:\Program Files\Microsoft Synchronization Services
2008-01-05 02:03 ——— d—–w C:\Program Files\Microsoft SDKs
2008-01-05 01:58 88,576 —-a-w C:\Windows\System32\infocardapi.dll
2008-01-05 01:58 579,584 —-a-w C:\Windows\System32\icardagt.exe
2008-01-05 01:58 11,776 —-a-w C:\Windows\System32\icardres.dll
2008-01-05 01:57 779,800 —-a-w C:\Windows\System32\PresentationNative_v0300.dll
2008-01-05 01:57 350,744 —-a-w C:\Windows\System32\PresentationHost.exe
2008-01-05 01:57 33,304 —-a-w C:\Windows\System32\PresentationHostProxy.dll
2008-01-05 01:57 106,520 —-a-w C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2008-01-05 01:39 96,760 —-a-w C:\Windows\System32\dfshim.dll
2008-01-05 01:39 84,480 —-a-w C:\Windows\System32\mscories.dll
2008-01-05 01:39 41,984 —-a-w C:\Windows\System32\netfxperf.dll
2008-01-05 01:39 282,112 —-a-w C:\Windows\System32\mscoree.dll
2008-01-05 01:39 158,720 —-a-w C:\Windows\System32\mscorier.dll
2008-01-05 01:38 ——— d—–w C:\Program Files\Google
2008-01-04 16:23 ——— d—–w C:\Program Files\NetDog
2008-01-04 13:00 ——— d—–w C:\Program Files\DivX
2008-01-03 02:48 ——— d—–w C:\Program Files\Graph
2008-01-02 08:50 ——— d—–w C:\Program Files\Mudbox
2007-12-28 03:21 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\CB Model Pro
2007-12-28 03:21 ——— d—–w C:\Program Files\CB Model Pro
2007-12-28 03:19 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-28 03:19 ——— d—–w C:\Program Files\Ulead Systems
2007-12-28 02:01 ——— d—–w C:\Program Files\Blender Foundation
2007-12-28 00:50 ——— d—–w C:\Program Files\Real Desktop
2007-12-28 00:20 ——— d—–w C:\ProgramData\Yahoo!
2007-12-27 13:00 ——— d—–w C:\Program Files\Yahoo!
2007-12-27 06:29 ——— d—–w C:\Program Files\Alex Feinman
2007-12-27 01:48 ——— d—–w C:\ProgramData\Adobe Systems
2007-12-27 01:46 ——— d—–w C:\Program Files\Common Files\Adobe Systems Shared
2007-12-26 09:23 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\Corel
2007-12-26 08:58 ——— d—–w C:\Program Files\Corel
2007-12-26 05:14 ——— d—–w C:\ProgramData\Stardock
2007-12-26 05:14 ——— d—–w C:\Program Files\Stardock
2007-12-26 03:50 ——— d—–w C:\Program Files\Common Files\xing shared
2007-12-26 03:49 ——— d—–w C:\Program Files\Real
2007-12-26 03:49 ——— d—–w C:\Program Files\Common Files\Real
2007-12-26 02:54 ——— d—–w C:\Users\MasterRaven\AppData\Roaming\PeerNetworking
2007-12-26 02:47 ——— d—–w C:\ProgramData\Forge of Games
2007-12-26 02:38 ——— d—–w C:\ProgramData\FreeDownloadManager.ORG
2007-12-26 02:38 ——— d—–w C:\Program Files\Free Download Manager
2007-12-26 02:31 ——— d—–w C:\Program Files\CDisplay
2007-12-26 01:41 9,344 —-a-w C:\Windows\system32\drivers\NSDriver.sys
2007-12-26 01:41 8,320 —-a-w C:\Windows\system32\drivers\AWRTRD.sys
2007-12-26 01:37 ——— d—–w C:\ProgramData\Lavasoft
2007-12-26 01:37 ——— d—–w C:\Program Files\Lavasoft
2007-12-26 01:37 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-26 01:36 ——— d—–w C:\Program Files\Notepad++
2007-12-26 00:42 ——— d—–w C:\ProgramData\Yahoo! Companion
2007-12-25 13:09 ——— d—–w C:\Program Files\RocketDock
2007-12-25 08:42 174 –sha-w C:\Program Files\desktop.ini
2007-12-25 08:37 ——— d—–w C:\Program Files\Windows Calendar
2007-12-25 04:41 ——— d—–w C:\Program Files\Microsoft ActiveSync
2007-12-25 04:41 ——— d—–w C:\Program Files\Common Files\L&H
2007-12-25 04:30 ——— d—–w C:\Program Files\CCleaner
2007-12-25 04:19 8,147,968 —-a-w C:\Windows\System32\wmploc.DLL
2007-12-25 04:19 7,680 —-a-w C:\Windows\System32\spwmp.dll
2007-12-25 04:19 4,096 —-a-w C:\Windows\System32\dxmasf.dll
2007-12-25 04:19 356,864 —-a-w C:\Windows\System32\MediaMetadataHandler.dll
2007-12-25 04:18 1,191,936 —-a-w C:\Windows\System32\msxml3.dll
2007-12-25 04:17 1,327,104 —-a-w C:\Windows\System32\quartz.dll
2007-12-25 04:16 9,728 —-a-w C:\Windows\System32\LAPRXY.DLL
2007-12-25 04:16 223,232 —-a-w C:\Windows\System32\WMASF.DLL
2007-12-25 04:15 1,335,296 —-a-w C:\Windows\System32\msxml6.dll
2007-12-25 04:13 84,480 —-a-w C:\Windows\System32\INETRES.dll
2007-12-25 04:13 737,792 —-a-w C:\Windows\System32\inetcomm.dll
2007-12-25 04:11 84,992 —-a-w C:\Windows\system32\drivers\srvnet.sys
2007-12-25 04:11 58,368 —-a-w C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-25 04:11 130,048 —-a-w C:\Windows\system32\drivers\srv2.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 13:58 495616]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2007-12-16 20:39 2449455]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-07 06:55 1006264]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-05-23 13:35 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-05-23 13:35 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-05-23 13:35 81920]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-06-13 09:50 174872]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-28 16:29 4472832 C:\Windows\RtHDVCpl.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 10:03 857648]
"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2007-06-29 11:16 707080]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 19:38 40048]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-12 06:00 1286144]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-26 07:33 457216]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-25 04:38 206952]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 12:44 107112]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-11-21 12:42 22696]
"Acer Tour"="" []
"PLFSet"="C:\Windows\PLFSet.dll" [2007-04-25 18:47 45056]
"eRecoveryService"="" []
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-23 06:49 151552]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-26 11:49 185896]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-10-18 09:19 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-10-18 09:18 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-10-18 09:18 133656]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe" [2007-09-12 18:27 492912]

C:\Users\MasterRaven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe [2007-07-21 01:57:16 2913584]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-05-18 22:16:02 727856]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-08-07 07:28:10 535336]

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-26 07:34]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-26 07:34]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-26 07:34]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080215.002\IDSvix86.sys [2008-02-14 00:18]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-03 07:51]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-15 05:31]
R2 eDataSecurity Service;eDataSecurity Service;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-26 07:34]
R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-06-14 07:54]
R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-29 09:50]
R2 int15;int15;C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 23:12]
R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-25 03:57]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29]
R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-14 02:23]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-10-18 09:05]
R3 NETw4v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-06-21 04:51]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC);C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-06-12 15:38]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 19:55]
R3 winbondcir;Winbond IR Transceiver;C:\Windows\system32\DRIVERS\winbondcir.sys [2007-03-28 22:51]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-23 06:00]
S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-30 03:46]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 14:20]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 14:20]
S3 WSVD;WSVD;C:\Windows\system32\drivers\WSVD.sys [2006-09-19 21:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b2d710c-b29e-11dc-ac37-c8d42b03bcf9}]
\shell\AutoRun\command - G:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-11 11:59:59 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - willy.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 11:52:20
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-21 11:53:02
ComboFix-quarantined-files.txt 2008-02-21 03:53:00
ComboFix2.txt 2008-02-21 01:22:32
.
2008-02-19 23:47:22 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:08 AM, on 2/21/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Users\MASTER~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.ph.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ph.acer.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\MASTER~1\AppData\Local\Temp\rcuqboeo.dll",run
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

–
End of file - 13045 bytes

LDTate

Post #6February 21, 2008, 12:36 PM UTC

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\MASTER~1\AppData\Local\Temp\rcuqboeo.dll",run

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete these Files if listed:
C:\Users\MASTER~1\AppData\Local\Temp <–ALL items in this Folder. Don't delete the folder itself.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

LDDI

Post #7February 25, 2008, 12:59 PM UTC

The notification at start-up is gone, and it seems to be behaving normally. Below is the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:58:33 PM, on 2/25/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Users\MASTER~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.ph.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ph.acer.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

–
End of file - 12786 bytes

LDTate

Post #8February 25, 2008, 4:53 PM UTC

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
If shown the disclaimer, Select "2"

Log looks good

LDTate

Post #9February 26, 2008, 10:32 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] I am unable to diagnose my problem, any assistance wou

✨ Ask AI

Ask AI