Spyware / Malware / Virus Removal

[Resolved] No internet and no executables work

13 min read

Looking for the outcome? Ask AI

Craymo1 Topic Starter

Post #1December 1, 2008, 12:31 AM UTC

About a day ago I got a Antispyware Trigger virus showing up saying I was infected and scanning my system. I removed that but now nothing seems to work (internet connection, browser, or any .exe applications), they all freeze shortly after launcing including Hijackthis. I ran a hijack this log in safe mode and got the following:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:49:31 PM, on 11/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AnvTrgrWarningBHO Class - {95E9BCC0-2E84-4500-8A9C-0B7A96769124} - C:\Program Files\AnvTrgrsoftware\AnvTrgrWarning.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Browser Toolbar - {2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E} - C:\Program Files\WebMediaViewer\browseul.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Program Files\WebMediaViewer\hpmon.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://linksyssupport.webex.com/client/T26…ort/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://webvpn.jpmorganchase.com/dana-cache…perSetupSP1.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: evacuative - {4d5b7736-a3bc-4e5b-9fa2-1bcc3e587abb} - C:\WINDOWS\system32\cwegus.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 10248 bytes

Any thoughts?

Tomk

Post #2December 1, 2008, 1:02 AM UTC

Hi Craymo1,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual user account.
Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log

Craymo1

Post #3December 1, 2008, 2:14 AM UTC

Ok, report and then fresh Hijack this, Hijack this ran succesfully in normal mode this time but then PC froze up again.

SDFix: Version 1.240
Run by [removed] on Sun 11/30/2008 at 08:38 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 20:44:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\C3ADD720FEBA11A0]
"Type"=dword:00000001
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=str(2):"\??\C:\Documents and Settings\Karla\Desktop\C3ADD720FEBA11A0\C3ADD720FEBA11A0"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\C3ADD720FEBA11A0\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\C3ADD720FEBA11A0]
"Type"=dword:00000001
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=str(2):"\??\C:\Documents and Settings\Karla\Desktop\C3ADD720FEBA11A0\C3ADD720FEBA11A0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\C3ADD720FEBA11A0\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,..

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\mqsvc.exe"="C:\\WINDOWS\\system32\\mqsvc.exe:*:Enabled:Message Queuing"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Shareaza\\Shareaza.exe"="C:\\Program Files\\Shareaza\\Shareaza.exe:*:Enabled:Shareaza"
"C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"="C:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe:*:Enabled:Secure Application Manager Proxy"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Movie Maker\\moviemk.exe"="C:\\Program Files\\Movie Maker\\moviemk.exe:*:Enabled:Windows Movie Maker"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\mqsvc.exe"="C:\\WINDOWS\\system32\\mqsvc.exe:*:Enabled:Message Queuing"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :

Files with Hidden Attributes :

Sun 13 Apr 2008 60,416 A.SH. — "C:\Program Files\Outlook Express\msimn.exe"
Wed 19 Mar 2008 212,992 A..H. — "C:\Program Files\Google\Google Desktop Search\BIT5D.tmp"
Sun 20 Jan 2008 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:51:09 PM, on 11/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AnvTrgrWarningBHO Class - {95E9BCC0-2E84-4500-8A9C-0B7A96769124} - C:\Program Files\AnvTrgrsoftware\AnvTrgrWarning.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://linksyssupport.webex.com/client/T26…ort/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://webvpn.jpmorganchase.com/dana-cache…perSetupSP1.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O22 - SharedTaskScheduler: evacuative - {4d5b7736-a3bc-4e5b-9fa2-1bcc3e587abb} - C:\WINDOWS\system32\cwegus.dll (file missing)
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 11430 bytes

Tomk

Post #4December 1, 2008, 2:29 AM UTC

Craymo1,

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Craymo1

Post #5December 1, 2008, 3:17 AM UTC

Couldn'd download recovery console as I cant access the internet due to the issue but below is the combofix log:

ComboFix 08-11-30.01 - Karla 2008-11-30 22:09:12.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.821 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-11-01 to 2008-12-01 )))))))))))))))))))))))))))))))
.

2008-11-30 20:37 . 2008-11-30 20:37 578,560 –a—— c:\windows\system32\dllcache\user32.dll
2008-11-30 20:36 . 2008-11-30 20:36 d——– c:\windows\ERUNT
2008-11-30 20:34 . 2008-11-30 20:47 d——– C:\SDFix
2008-11-30 19:57 . 2008-11-30 19:57 d——– c:\documents and settings\All Users\Application Data\Avg8
2008-11-30 19:56 . 2008-11-30 19:56 d——– c:\documents and settings\Karla\Application Data\AVGTOOLBAR
2008-11-30 18:50 . 2008-11-30 18:50 d——– c:\program files\AVG
2008-11-30 18:50 . 2008-11-30 18:50 10,520 ——— c:\windows\system32\avgrsstx.dll.install_backup
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\Karla\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-10-22 16:27 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-30 18:26 . 2008-10-22 16:27 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\Karla\Application Data\muvee Technologies
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\All Users\Application Data\muvee Technologies
2008-11-30 17:00 . 2008-11-30 17:00 d–hs—- C:\found.000
2008-11-30 16:49 . 2008-11-30 16:49 d——– c:\program files\Trend Micro
2008-11-29 14:03 . 2008-11-29 14:03 0 —h—– c:\windows\f49f4d98.dat
2008-11-29 14:01 . 2008-11-29 14:01 1 —h—– c:\windows\bemark2.dat
2008-11-29 14:00 . 2008-11-30 13:54 d-a—— c:\documents and settings\All Users\Application Data\TEMP
2008-11-29 13:59 . 2008-11-29 13:59 d——– c:\program files\WebMediaViewer
2008-11-29 13:59 . 2008-11-29 13:59 1 —h—– c:\windows\f49f4daa.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 00:58 ——— d—–w c:\program files\Creative
2008-11-24 14:07 ——— d—–w c:\program files\Full Tilt Poker
2008-10-26 13:12 822,272 —-a-w c:\windows\system32\drivers\BCMWL5.SYS
2008-10-26 13:12 ——— d—–w c:\documents and settings\Karla\Application Data\InstallShield
2008-10-26 04:11 ——— d—–w c:\documents and settings\Karla\Application Data\GTek
2008-10-26 04:07 ——— d—–w c:\program files\Broadcom
2008-10-21 11:43 ——— d—–w c:\program files\BigLots
2008-10-15 16:34 337,408 —-a-w c:\windows\system32\dllcache\netapi32.dll
2008-10-04 01:02 ——— d—–w c:\program files\NOS
2008-10-04 01:02 ——— d—–w c:\documents and settings\All Users\Application Data\NOS
2008-10-03 19:23 ——— d—–w c:\program files\Common Files\Adobe AIR
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-10-02 18:21 ——— d—–w c:\program files\UserTesting.com
2008-10-02 18:21 ——— d—–w c:\documents and settings\Karla\Application Data\TestingRecorder
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Sonic
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Leadertech
2008-10-02 02:14 ——— d—–w c:\documents and settings\All Users\Application Data\WinZip
2008-10-02 02:05 ——— d—–w c:\program files\Google
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\dllcache\win32k.sys
2008-09-08 10:41 333,824 ——w c:\windows\system32\dllcache\srv.sys
2008-01-14 02:30 3,006,976 –sha-w c:\program files\ehthumbs.db
.

((((((((((((((((((((((((((((( snapshot@2008-11-30_17.04.00.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-12-01 01:36:15 3,948,544 —-a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:15 262,144 —-a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-12-01 01:36:14 3,948,544 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:14 262,144 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-11-30 21:45:55 66,486 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-01 01:47:17 66,888 —-a-w c:\windows\system32\perfc009.dat
- 2008-11-30 21:45:55 417,048 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-01 01:47:17 417,616 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
c:\program files\AnvTrgrsoftware\AnvTrgrWarning.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"com.codeode.cactusspamfilter"="c:\program files\Cactus Spam Filter 2.13\cactusspamfilter.exe" [2006-04-30 749568]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-11 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-27 7585792]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
"nwiz"="nwiz.exe" [2006-09-27 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-01 c:\windows\system32\CHDAudPropShortcut.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnvTrgr]
c:\program files\AnvTrgrsoftware\AnvTrgr.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sysftray2]
c:\windows\bolivar27.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Movie Maker\\moviemk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S1 NEOFLTR_550_12415;Juniper Networks TDI Filter Driver (NEOFLTR_550_12415);\??\c:\windows\system32\Drivers\NEOFLTR_550_12415.SYS [2007-12-07 63008]
S2 C3ADD720FEBA11A0;C3ADD720FEBA11A0;\??\c:\documents and settings\Karla\Desktop\C3ADD720FEBA11A0\C3ADD720FEBA11A0 []
S2 COM+ System Application (COMSysApp) ;COM+ System Application (COMSysApp) ;c:\program files\tinyproxy\tinyproxy.exe []
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys [2006-06-06 61952]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]

*Newly Created Service* - MDMXSDK
.
Contents of the 'Scheduled Tasks' folder

2008-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.
- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{4d5b7736-a3bc-4e5b-9fa2-1bcc3e587abb} - c:\windows\system32\cwegus.dll

.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\Karla\Application Data\Mozilla\Firefox\Profiles\x4r5rsnx.default\
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 22:11:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\C3ADD720FEBA11A0]
"ImagePath"="\??\c:\documents and settings\Karla\Desktop\C3ADD720FEBA11A0\C3ADD720FEBA11A0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\C3ADD720FEBA11A0]
"ImagePath"="\??\c:\documents and settings\Karla\Desktop\C3ADD720FEBA11A0\C3ADD720FEBA11A0"
.
Completion time: 2008-11-30 22:13:13
ComboFix-quarantined-files.txt 2008-12-01 03:12:22
ComboFix2.txt 2008-11-30 22:41:49

Pre-Run: 33,163,448,320 bytes free
Post-Run: 33,146,986,496 bytes free

169 — E O F — 2008-11-13 01:11:30

Tomk

Post #6December 1, 2008, 4:45 AM UTC

Craymo1,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
c:\windows\f49f4d98.dat
c:\windows\bemark2.dat
c:\windows\f49f4daa.dat
c:\windows\bolivar27.exe
c:\program files\tinyproxy

Rootkit::
C:\WINDOWS\system32\drivers\core.cache.dsk

Folder::
c:\documents and settings\All Users\Application Data\TEMP
c:\program files\WebMediaViewer
c:\program files\Full Tilt Poker
c:\documents and settings\Karla\Desktop\C3ADD720FEBA11A0

Driver::
"COM+ System Application (COMSysApp) "
C3ADD720FEBA11A0

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sysftray2]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Craymo1

Post #7December 2, 2008, 12:05 AM UTC

Ok, logs below. Computer is definately responding better now, normal mode works and does not freeze up. Executables work, however internet connection is not working. Browser defaults to About Blank page and cannot browse even though icon in system tray and network connections show active connection (tried reparing connection and that didnt help).

ComboFix 08-11-30.01 - Karla 2008-12-01 18:40:54.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.822 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karla\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\program files\tinyproxy
c:\windows\bemark2.dat
c:\windows\bolivar27.exe
c:\windows\f49f4d98.dat
c:\windows\f49f4daa.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\TEMP
c:\program files\Full Tilt Poker
c:\program files\Full Tilt Poker\Aft.bin
c:\program files\Full Tilt Poker\Cache\42D4EB830001.dc
c:\program files\Full Tilt Poker\Cache\750-DCS.png
c:\program files\Full Tilt Poker\Cache\Double_Deuce_DCS.png
c:\program files\Full Tilt Poker\Cache\en-0100-happy-hour-DCS.png
c:\program files\Full Tilt Poker\Cache\en-1400-happy-hour-DCS.png
c:\program files\Full Tilt Poker\Cache\en-1500_HappyHourDCS.png
c:\program files\Full Tilt Poker\Cache\en-150seats.png
c:\program files\Full Tilt Poker\Cache\en-1900_HappyHourDCS.png
c:\program files\Full Tilt Poker\Cache\en-2300_HappyHourDCS.png
c:\program files\Full Tilt Poker\Cache\en-25k-Heads-up-DCS.png
c:\program files\Full Tilt Poker\Cache\en-25k_Heads_Up_Champion_DCS.png
c:\program files\Full Tilt Poker\Cache\en-benyamine-dcs.png
c:\program files\Full Tilt Poker\Cache\en-ftops-ix-event01.png
c:\program files\Full Tilt Poker\Cache\en-ftops-ix-event02.png
c:\program files\Full Tilt Poker\Cache\en-ftops-ix-event06.png
c:\program files\Full Tilt Poker\Cache\en-ftops-ix-more.png
c:\program files\Full Tilt Poker\Cache\en-FTOPS_VIII_Event20.png
c:\program files\Full Tilt Poker\Cache\en-FTOPS_VIII_Event21.png
c:\program files\Full Tilt Poker\Cache\en-FTOPS_VIII_Event22.png
c:\program files\Full Tilt Poker\Cache\en-FTOPS_VIII_Event24.png
c:\program files\Full Tilt Poker\Cache\en-HappyHourDCS.png
c:\program files\Full Tilt Poker\Cache\en-hollink-dcs.png
c:\program files\Full Tilt Poker\Cache\en-ironman-myb-dcs.png
c:\program files\Full Tilt Poker\Cache\en-jens-vortmann-dcs.png
c:\program files\Full Tilt Poker\Cache\en-Limit_HappyHourDCS.png
c:\program files\Full Tilt Poker\Cache\en-msop-dcs.png
c:\program files\Full Tilt Poker\Cache\en-Ring_HappyHourDCS.png
c:\program files\Full Tilt Poker\Cache\en-sng-madness-IV.png
c:\program files\Full Tilt Poker\Cache\en-wsop-08-pescatori-dcs.png
c:\program files\Full Tilt Poker\Cache\en-wsop-18-matusow.png
c:\program files\Full Tilt Poker\Cache\en-wsop-event1-medic-v2.png
c:\program files\Full Tilt Poker\Cache\en-wsop-tran-dcs.png
c:\program files\Full Tilt Poker\Cache\en-WSOP08-e3-Singer.png
c:\program files\Full Tilt Poker\Cache\en-WSOP08-e4-Lindgren.png
c:\program files\Full Tilt Poker\Cache\ftops-VII.png
c:\program files\Full Tilt Poker\Cache\ftops-x.png
c:\program files\Full Tilt Poker\Cache\Ironman_Plus_DCS.png
c:\program files\Full Tilt Poker\Cache\my-promotions.png
c:\program files\Full Tilt Poker\Cache\Sit&GoMadness_2.png
c:\program files\Full Tilt Poker\Cache\SundayBrawl_DCS.png
c:\program files\Full Tilt Poker\Fonts\Univers-Bold.otf
c:\program files\Full Tilt Poker\Fonts\Univers-Condensed.otf
c:\program files\Full Tilt Poker\Fonts\Univers-CondensedBold.otf
c:\program files\Full Tilt Poker\Fonts\Univers-CondensedLight.otf
c:\program files\Full Tilt Poker\Fonts\Univers-Light.otf
c:\program files\Full Tilt Poker\FullTiltPoker.exe
c:\program files\Full Tilt Poker\Graphics\Cashier\Bonus_Account_Box.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Bonus_Account_Table_Box.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Bonus_HappyHour_Left.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Bonus_HappyHour_Right.png
c:\program files\Full Tilt Poker\Graphics\Cashier\BonusAccount_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\BonusAccount_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Cashier.jpg
c:\program files\Full Tilt Poker\Graphics\Cashier\CashierBlue_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\CashierBlue_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Convert_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Convert_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\DCS_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\DCS_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\DepositOptions\Deposit_Verify.jpg
c:\program files\Full Tilt Poker\Graphics\Cashier\Detach_Win_Icon.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Exit_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Exit_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\FTPstore_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\FTPstore_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\GiftCert_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\GiftCert_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\History_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\History_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\InfoEdit_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\InfoEdit_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\MakeDepositLg_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\MakeDepositLg_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\MakeDepositSm_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\MakeDepositSm_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Progress_Bar_Green.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Progress_Bar_White.png
c:\program files\Full Tilt Poker\Graphics\Cashier\ReloadPlayChips_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\ReloadPlayChips_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Store_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Store_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Transfer_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Transfer_On.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Withdraw_Off.png
c:\program files\Full Tilt Poker\Graphics\Cashier\Withdraw_On.png
c:\program files\Full Tilt Poker\Graphics\CSChat\FTG_Left.png
c:\program files\Full Tilt Poker\Graphics\CSChat\FTG_Mid.png
c:\program files\Full Tilt Poker\Graphics\CSChat\FTG_Right.png
c:\program files\Full Tilt Poker\Graphics\CSChat\FTP_Logo.png
c:\program files\Full Tilt Poker\Graphics\CSChat\HeadingLine.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Sit&Go_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Sit&Go_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Sit&Go_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Danish\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Dutch\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Finnish\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\French\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\French\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\German\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\German\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Italian\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Norwegian\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Portuguese\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\MixedGames_dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\MixedGames_off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\MixedGames_on.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\ProChat_dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\ProChat_off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\ProChat_on.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\SitNGo_dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\SitNGo_off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\SitNGo_on.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\Special_dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\Special_off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\Special_on.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\Tournaments_dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\Tournaments_off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\Tournaments_on.png
c:\program files\Full Tilt Poker\Graphics\LNG\Russian\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Spanish\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\Special_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\LNG\Swedish\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\CheckBox_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\CheckBox_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\chip_100percent.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\chip_20percent.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\0.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\1.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\2.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\3.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\4.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\5.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\6.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\7.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\8.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\9.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Clock\Colon.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Default_Adv.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\HideFullTables.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Legend.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\LoaderChip.gif
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Lobby.jpg
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\LobbyCenter.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\LobbyMiddle.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\PleaseCheck.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\PPA_Deck.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\PPA_Logo.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\PromotionSlider.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Refer_Splash.jpg
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\Show.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\SiteFound.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Backgrounds\VerticalLine.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\ArrowDown.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\ArrowUp.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Cashier_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Cashier_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Edit_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Edit_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\FTR_Play_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\FTR_Play_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\FTR_Play_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\FTR_Real_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\FTR_Real_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\FTR_Real_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\PlayerNotesColours.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\ProChat\ChatSchedule_center.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\ProChat\ChatSchedule_left.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\ProChat\ChatSchedule_right.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\ProChat\JoinChat_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\ProChat\JoinChat_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\Players\Players_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\Players\Players_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\Players\WaitingList_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\Players\WaitingList_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\Players\WaitingList_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\Tables\Checkbox.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\Tables\Stakes.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\ViewTable_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\ViewTable_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\WaitList_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Ring\WaitList_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\2Handed.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\6Handed.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\AddOn.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Bounty.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\DeepStack.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\DoubleStack.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\GoToTourneyLobby_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\GotoTourneyLobby_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\HappyHour.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Legend.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Matrix.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Rebuy.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\RegisterNow_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\RegisterNow_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\ShootOut.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\SitNGo\FTR_Satellites_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\SitNGo\FTR_Satellites_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_FTOPS_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_FTOPS_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_Guarantees_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_Guarantees_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_LiveEvents_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_LiveEvents_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_PAD_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_PAD_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_Satellites_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_Satellites_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_Series_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Special\FTR_Series_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Cash_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Cash_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_FTOPS_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_FTOPS_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Private_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Private_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Satellites_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Satellites_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Series_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Tourn\FTR_Series_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Buttons\Tourn\Turbo.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Czech.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Danish.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Dutch.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\English.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Finnish.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\French.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\German.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Italian.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Japanese.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Korean.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Norwegian.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Polish.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Portuguese.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Russian.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Spanish.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Swedish.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Language\Turkish.bmp
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\HoldEm_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\HoldEm_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\HoldEm_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\MixedGames_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\MixedGames_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\MixedGames_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Omaha_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Omaha_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Omaha_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\OmahaHiLo_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\OmahaHiLo_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\OmahaHiLo_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\ProChat_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\ProChat_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\ProChat_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Razz_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Razz_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Razz_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\SitNGo_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\SitNGo_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\SitNGo_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Special_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Special_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Special_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Stud_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Stud_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Stud_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\StudHiLo_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\StudHiLo_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\StudHiLo_On.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Tournaments_Dis.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Tournaments_Off.png
c:\program files\Full Tilt Poker\Graphics\Lobby\Tabs\Tournaments_On.png
c:\program files\Full Tilt Poker\Graphics\NewAccount\Help_Off.png
c:\program files\Full Tilt Poker\Graphics\NewAccount\Help_On.png
c:\program files\Full Tilt Poker\Graphics\NewAccount\ProgressBar_Off.png
c:\program files\Full Tilt Poker\Graphics\NewAccount\ProgressBar_On.png
c:\program files\Full Tilt Poker\Graphics\NewAccount\PromoImage0.png
c:\program files\Full Tilt Poker\Graphics\NewAccount\Tick_Off.png
c:\program files\Full Tilt Poker\Graphics\NewAccount\Tick_On.png
c:\program files\Full Tilt Poker\Graphics\ProChat\Logo.png
c:\program files\Full Tilt Poker\Graphics\ProChat\PostedQA.png
c:\program files\Full Tilt Poker\Graphics\ProChat\Question.png
c:\program files\Full Tilt Poker\Graphics\ProChat\QuestionFrom.png
c:\program files\Full Tilt Poker\Graphics\ProChat\Questions.png
c:\program files\Full Tilt Poker\Graphics\ProChat\Response.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Left_Dis.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Left_Off.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Left_On.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Mid_Dis.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Mid_Off.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Mid_On.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Right_Dis.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Right_Off.png
c:\program files\Full Tilt Poker\Graphics\System\BigBTN_Right_On.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Left_Dis.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Left_Off.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Left_On.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Mid_Dis.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Mid_Off.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Mid_On.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Right_Dis.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Right_Off.png
c:\program files\Full Tilt Poker\Graphics\System\BTN_Right_On.png
c:\program files\Full Tilt Poker\Graphics\System\FTR_Left_Off.png
c:\program files\Full Tilt Poker\Graphics\System\FTR_Left_On.png
c:\program files\Full Tilt Poker\Graphics\System\FTR_Mid_Off.png
c:\program files\Full Tilt Poker\Graphics\System\FTR_Mid_On.png
c:\program files\Full Tilt Poker\Graphics\System\FTR_Right_Off.png
c:\program files\Full Tilt Poker\Graphics\System\FTR_Right_On.png
c:\program files\Full Tilt Poker\Graphics\System\HDR_Divider.png
c:\program files\Full Tilt Poker\Graphics\System\HDR_Off.png
c:\program files\Full Tilt Poker\Graphics\System\HDR_On.png
c:\program files\Full Tilt Poker\Graphics\System\HDR2_Divider.png
c:\program files\Full Tilt Poker\Graphics\System\HDR2_Off.png
c:\program files\Full Tilt Poker\Graphics\System\HDR2_On.png
c:\program files\Full Tilt Poker\Graphics\System\Pattern_Short.jpg
c:\program files\Full Tilt Poker\Graphics\System\Pattern_Tall.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\emptybox.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\hilite_1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\hilite_2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\0\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\0\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\0\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\0\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\1\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\1\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\1\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\1\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\10\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\10\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\10\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\10\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\11\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\11\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\11\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\11\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\12\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\12\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\12\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\12\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\13\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\13\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\13\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\13\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\14\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\14\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\14\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\14\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\15\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\15\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\15\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\15\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\16\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\16\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\16\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\16\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\17\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\17\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\17\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\17\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\18\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\18\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\18\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\18\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\19\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\19\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\19\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\19\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\2\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\2\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\2\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\2\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\20\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\20\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\20\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\20\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\3\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\3\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\3\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\3\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\4\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\4\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\4\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\4\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\5\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\5\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\5\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\5\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\6\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\6\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\6\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\6\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\7\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\7\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\7\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\7\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\8\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\8\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\8\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\8\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\9\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\9\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\9\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\9\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Private\private.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\0\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\0\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\0\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\0\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\1\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\1\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\1\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\1\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\10\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\10\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\10\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\10\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\100\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\100\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\100\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\100\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\11\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\11\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\11\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\11\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\12\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\12\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\12\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\12\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\13\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\13\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\13\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\13\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\14\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\14\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\14\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\14\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\15\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\15\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\15\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\15\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\16\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\16\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\16\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\16\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\17\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\17\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\17\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\17\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\18\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\18\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\18\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\18\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\19\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\19\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\19\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\19\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\2\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\2\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\2\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\2\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\20\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\20\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\20\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\20\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\21\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\21\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\21\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\21\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\22\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\22\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\22\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\22\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\23\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\23\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\23\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\23\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\24\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\24\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\24\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\24\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\25\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\25\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\25\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\25\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\26\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\26\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\26\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\26\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\27\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\27\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\27\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\27\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\28\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\28\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\28\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\28\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\29\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\29\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\29\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\29\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\3\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\3\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\3\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\3\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\30\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\30\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\30\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\30\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\31\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\31\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\31\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\31\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\32\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\32\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\32\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\32\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\33\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\33\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\33\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\33\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\34\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\34\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\34\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\34\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\35\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\35\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\35\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\35\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\36\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\36\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\36\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\36\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\37\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\37\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\37\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\37\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\38\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\38\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\38\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\38\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\39\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\39\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\39\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\39\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\4\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\4\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\4\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\4\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\40\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\40\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\40\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\40\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\41\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\41\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\41\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\41\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\42\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\42\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\42\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\42\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\43\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\43\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\43\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\43\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\44\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\44\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\44\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\44\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\45\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\45\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\45\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\45\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\46\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\46\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\46\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\46\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\47\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\47\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\47\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\47\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\48\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\48\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\48\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\48\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\49\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\49\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\49\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\49\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\5\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\5\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\5\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\5\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\50\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\50\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\50\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\50\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\51\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\51\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\51\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\51\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\52\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\52\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\52\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\52\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\53\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\53\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\53\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\53\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\54\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\54\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\54\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\54\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\55\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\55\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\55\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\55\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\56\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\56\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\56\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\56\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\57\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\57\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\57\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\57\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\58\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\58\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\58\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\58\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\59\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\59\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\59\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\59\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\6\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\6\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\6\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\6\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\60\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\60\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\60\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\60\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\61\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\61\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\61\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\61\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\62\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\62\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\62\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\62\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\63\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\63\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\63\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\63\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\64\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\64\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\64\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\64\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\65\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\65\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\65\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\65\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\66\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\66\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\66\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\66\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\67\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\67\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\67\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\67\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\68\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\68\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\68\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\68\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\69\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\69\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\69\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\69\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\7\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\7\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\7\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\7\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\70\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\70\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\70\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\70\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\71\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\71\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\71\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\71\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\72\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\72\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\72\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\72\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\73\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\73\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\73\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\73\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\74\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\74\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\74\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\74\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\75\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\75\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\75\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\75\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\76\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\76\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\76\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\76\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\77\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\77\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\77\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\77\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\78\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\78\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\78\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\78\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\79\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\79\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\79\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\79\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\8\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\8\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\8\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\8\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\80\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\80\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\80\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\80\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\81\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\81\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\81\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\81\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\82\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\82\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\82\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\82\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\83\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\83\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\83\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\83\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\84\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\84\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\84\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\84\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\85\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\85\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\85\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\85\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\86\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\86\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\86\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\86\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\87\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\87\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\87\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\87\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\88\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\88\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\88\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\88\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\89\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\89\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\89\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\89\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\9\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\9\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\9\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\9\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\90\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\90\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\90\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\90\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\91\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\91\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\91\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\91\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\92\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\92\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\92\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\92\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\93\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\93\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\93\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\93\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\94\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\94\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\94\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\94\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\95\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\95\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\95\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\95\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\96\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\96\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\96\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\96\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\97\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\97\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\97\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\97\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\98\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\98\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\98\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\98\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\99\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\99\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\99\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\99\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Pro\pro.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\0\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\0\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\0\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\0\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\1\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\1\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\1\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\1\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\10\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\10\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\10\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\10\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\11\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\11\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\11\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\11\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\12\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\12\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\12\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\12\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\13\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\13\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\13\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\13\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\14\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\14\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\14\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\14\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\15\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\15\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\15\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\15\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\16\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\16\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\16\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\16\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\17\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\17\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\17\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\17\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\18\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\18\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\18\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\18\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\19\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\19\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\19\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\19\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\2\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\2\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\2\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\2\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\20\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\20\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\20\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\20\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\21\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\21\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\21\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\21\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\22\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\22\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\22\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\22\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\23\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\23\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\23\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\23\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\24\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\24\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\24\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\24\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\25\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\25\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\25\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\25\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\26\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\26\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\26\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\26\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\27\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\27\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\27\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\27\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\28\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\28\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\28\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\28\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\29\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\29\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\29\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\29\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\3\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\3\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\3\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\3\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\30\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\30\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\30\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\30\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\31\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\31\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\31\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\31\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\32\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\32\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\32\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\32\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\33\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\33\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\33\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\33\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\34\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\34\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\34\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\34\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\35\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\35\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\35\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\35\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\36\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\36\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\36\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\36\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\37\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\37\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\37\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\37\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\38\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\38\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\38\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\38\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\39\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\39\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\39\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\39\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\4\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\4\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\4\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\4\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\40\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\40\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\40\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\40\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\41\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\41\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\41\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\41\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\42\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\42\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\42\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\42\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\43\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\43\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\43\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\43\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\44\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\44\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\44\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\44\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\45\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\45\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\45\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\45\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\46\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\46\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\46\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\46\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\47\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\47\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\47\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\47\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\48\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\48\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\48\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\48\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\49\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\49\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\49\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\49\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\5\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\5\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\5\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\5\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\50\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\50\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\50\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\50\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\51\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\51\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\51\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\51\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\52\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\52\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\52\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\52\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\53\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\53\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\53\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\53\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\54\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\54\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\54\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\54\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\55\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\55\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\55\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\55\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\56\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\56\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\56\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\56\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\57\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\57\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\57\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\57\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\58\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\58\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\58\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\58\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\59\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\59\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\59\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\59\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\6\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\6\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\6\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\6\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\60\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\60\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\60\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\60\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\61\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\61\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\61\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\61\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\62\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\62\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\62\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\62\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\63\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\63\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\63\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\63\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\64\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\64\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\64\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\64\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\65\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\65\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\65\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\65\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\66\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\66\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\66\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\66\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\67\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\67\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\67\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\67\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\68\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\68\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\68\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\68\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\69\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\69\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\69\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\69\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\7\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\7\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\7\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\7\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\70\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\70\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\70\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\70\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\71\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\71\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\71\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\71\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\72\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\72\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\72\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\72\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\8\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\8\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\8\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\8\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\9\0.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\9\1.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\9\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\9\3.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\Public\public.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\SeatRT_Empty.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\SeatRT_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Avatars\SeatRT_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Backgrounds.ini
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Beach Scene\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Beach Scene\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Beach Scene\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Beach Scene\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Beach Scene\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Beach Scene\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Final Table\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Final Table\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Final Table\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Final Table\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Final Table\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Final Table\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Jungle\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Jungle\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Jungle\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Jungle\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Jungle\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Jungle\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Midnight\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Midnight\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Midnight\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Midnight\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Midnight\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Midnight\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Outer Space\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Outer Space\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Outer Space\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Outer Space\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Outer Space\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Outer Space\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Plain\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Plain\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Plain\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Plain\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Plain\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Plain\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Ski Lodge\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Ski Lodge\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Ski Lodge\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Ski Lodge\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Ski Lodge\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Ski Lodge\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Vegas Skyline\10.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Vegas Skyline\2.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Vegas Skyline\6.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Vegas Skyline\8.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Vegas Skyline\9.png
c:\program files\Full Tilt Poker\Graphics\Table\Backgrounds\Vegas Skyline\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\BigButton_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\BigButton_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\CheckBox_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\CheckBox_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\GetChips_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\GetChips_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Info_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Info_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\LastHand_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\LastHand_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\LastHandTourney_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\LastHandTourney_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Layout_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Layout_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Lobby_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Lobby_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\OptionCheckbox_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\OptionCheckbox_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\OptionRadiobutton_Disabled.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\OptionRadiobutton_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\OptionRadiobutton_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Options_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Options_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\PlayMoney_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\PlayMoney_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\PlayMoneyRT_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\PlayMoneyRT_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Rebuy_Disabled.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Rebuy_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Rebuy_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\RebuyInfo_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\RebuyInfo_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\SmallButton_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\SmallButton_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Stand-Up_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Stand-Up_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Stats_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Buttons\Stats_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\Classic_Avatars_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\Classic_Avatars_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\Classic_NoAvatars_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\Classic_NoAvatars_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\RaceTrack_Avatars_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\RaceTrack_Avatars_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\RaceTrack_NoAvatars_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Choose\RaceTrack_NoAvatars_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\AdvanceActions.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\AvatarShadow.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\button_3.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\CapAmountBG.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Cards0.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Cards1.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Cards2.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Cards3.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Cards4.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Cards5.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Cards6.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\CardSmall.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ChatAttach_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ChatAttach_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ChatDetach_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ChatDetach_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ChipCover.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Chips0.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Chips1.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Chips2.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Chips3.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Chips4.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Chips5.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Chips6.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Diodes.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Divider.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\DividerRT.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Gripper.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_0.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_1.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_2.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_3.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_4.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_5.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_6.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\ironman_chip_def.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Muted.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\OptionMenu.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\OptionMenuRT.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\PPA.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\RankDiodes.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderBox.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderBoxBig.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderBoxSmall.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderCap_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderCap_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderCapBig_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderCapBig_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderCapSmall_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderCapSmall_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderHalfPot_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderHalfPot_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderHalfPotBig_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderHalfPotBig_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderHalfPotSmall_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderHalfPotSmall_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMax_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMax_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMaxBig_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMaxBig_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMaxSmall_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMaxSmall_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMin_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMin_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMinBig_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMinBig_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMinSmall_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderMinSmall_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderPot_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderPot_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderPotBig_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderPotBig_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderPotSmall_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderPotSmall_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderThumb.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderThumbBig.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\SliderThumbSmall.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Table.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TableRT.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TimeBank_Active.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TimeBank_Disconnect.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TimeBank_Inactive.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TimeBank_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TimeBank_On.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TimeBank_Reconnect.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\Timer.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\TimerRT.png
c:\program files\Full Tilt Poker\Graphics\Table\Elements\YouHaveBeenMoved.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Chat.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Dealer.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\FastForward_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\FastForward_On.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\FastRewind_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\FastRewind_On.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Forward_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Forward_On.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Header_Left.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Header_Right.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\ObserverChat.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Pod.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\PodHighlight_Green.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\PodHighlight_Red.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Rewind_Off.png
c:\program files\Full Tilt Poker\Graphics\Table\LastHand\Rewind_On.png
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Backgrounds.ini
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Blue Carpet\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\FinalTable\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Gold Carpet\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Green Carpet\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Marble\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Red Carpet\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Stainless\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Table\RaceTrack\Wood\Table.jpg
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\FTP_Logo.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\Left.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\LeftShort.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\Lobby2.jpg
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\Lobby3.jpg
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\Main.jpg
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\MatrixLeft.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\MatrixRight.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\MatrixSatellites.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\MatrixView.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\Middle.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\Right.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Backgrounds\Satellite.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\Cashier_Off.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\Cashier_On.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\MainLobby_Off.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\MainLobby_On.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\ObserveTable_Off.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\ObserveTable_On.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\OpenSatelliteLobby_Off.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\OpenSatelliteLobby_On.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\RegisterNow_Off.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\RegisterNow_On.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\TakeYourSeat_Off.png
c:\program files\Full Tilt Poker\Graphics\Tournament\Buttons\TakeYourSeat_On.png
c:\program files\Full Tilt Poker\Install.log
c:\program files\Full Tilt Poker\libeay32.dll
c:\program files\Full Tilt Poker\libexpat.dll
c:\program files\Full Tilt Poker\libjpeg.dll
c:\program files\Full Tilt Poker\libpng.dll
c:\program files\Full Tilt Poker\Microsoft.VC80.CRT.manifest
c:\program files\Full Tilt Poker\msvcr80.dll
c:\program files\Full Tilt Poker\preferences.orig
c:\program files\Full Tilt Poker\ShockOverDawk.dat
c:\program files\Full Tilt Poker\ShockOverDawk.xml
c:\program files\Full Tilt Poker\ssleay32.dll
c:\program files\Full Tilt Poker\StmOCX.dll
c:\program files\Full Tilt Poker\unicows.dll
c:\program files\Full Tilt Poker\Updater.exe
c:\program files\Full Tilt Poker\Waves\Alert-5.wav
c:\program files\Full Tilt Poker\Waves\Bell-2.wav
c:\program files\Full Tilt Poker\Waves\Bell-4.wav
c:\program files\Full Tilt Poker\Waves\Bell-5.wav
c:\program files\Full Tilt Poker\Waves\Bell-6.wav
c:\program files\Full Tilt Poker\Waves\Bell-7.wav
c:\program files\Full Tilt Poker\Waves\Bet-4.wav
c:\program files\Full Tilt Poker\Waves\Buzzer-2.wav
c:\program files\Full Tilt Poker\Waves\Checkmark-4.wav
c:\program files\Full Tilt Poker\Waves\Connect.avi
c:\program files\Full Tilt Poker\Waves\Deal-4.wav
c:\program files\Full Tilt Poker\Waves\Fold-3.wav
c:\program files\Full Tilt Poker\Waves\Mountain-9.wav
c:\program files\Full Tilt Poker\Waves\Raise-2.wav
c:\program files\Full Tilt Poker\Waves\Shuffle-4.wav
c:\program files\Full Tilt Poker\Waves\Sweep-3.wav
c:\program files\Full Tilt Poker\Waves\Sweep-5.wav
c:\program files\Full Tilt Poker\zlib1-ft.dll
c:\program files\WebMediaViewer
c:\program files\WebMediaViewer\browseu.exe
c:\program files\WebMediaViewer\browseul.dll
c:\program files\WebMediaViewer\hpmom.exe
c:\program files\WebMediaViewer\hpmon.exe
c:\program files\WebMediaViewer\hpmun.dll
c:\program files\WebMediaViewer\hpmun.exe
c:\program files\WebMediaViewer\myd.ico
c:\program files\WebMediaViewer\mym.ico
c:\program files\WebMediaViewer\myp.ico
c:\program files\WebMediaViewer\myv.ico
c:\program files\WebMediaViewer\ot.ico
c:\program files\WebMediaViewer\ts.ico
c:\windows\bemark2.dat
c:\windows\f49f4d98.dat
c:\windows\f49f4daa.dat
c:\documents and settings\Karla\Desktop\C3ADD720FEBA11A0 . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_C3ADD720FEBA11A0
——-\Legacy_COM+_SYSTEM_APPLICATION_(COMSYSAPP)_
——-\Service_C3ADD720FEBA11A0
——-\Service_COM+ System Application (COMSysApp)

((((((((((((((((((((((((( Files Created from 2008-11-01 to 2008-12-01 )))))))))))))))))))))))))))))))
.

2008-11-30 20:37 . 2008-11-30 20:37 578,560 –a—— c:\windows\system32\dllcache\user32.dll
2008-11-30 20:36 . 2008-11-30 20:36 d——– c:\windows\ERUNT
2008-11-30 20:34 . 2008-11-30 20:47 d——– C:\SDFix
2008-11-30 19:57 . 2008-11-30 19:57 d——– c:\documents and settings\All Users\Application Data\Avg8
2008-11-30 19:56 . 2008-11-30 19:56 d——– c:\documents and settings\Karla\Application Data\AVGTOOLBAR
2008-11-30 18:50 . 2008-11-30 18:50 d——– c:\program files\AVG
2008-11-30 18:50 . 2008-11-30 18:50 10,520 ——— c:\windows\system32\avgrsstx.dll.install_backup
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\Karla\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-10-22 16:27 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-30 18:26 . 2008-10-22 16:27 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\Karla\Application Data\muvee Technologies
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\All Users\Application Data\muvee Technologies
2008-11-30 17:00 . 2008-11-30 17:00 d–hs—- C:\found.000
2008-11-30 16:49 . 2008-11-30 16:49 d——– c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 00:58 ——— d—–w c:\program files\Creative
2008-10-26 13:12 822,272 —-a-w c:\windows\system32\drivers\BCMWL5.SYS
2008-10-26 13:12 ——— d—–w c:\documents and settings\Karla\Application Data\InstallShield
2008-10-26 04:11 ——— d—–w c:\documents and settings\Karla\Application Data\GTek
2008-10-26 04:07 ——— d—–w c:\program files\Broadcom
2008-10-21 11:43 ——— d—–w c:\program files\BigLots
2008-10-04 01:02 ——— d—–w c:\program files\NOS
2008-10-04 01:02 ——— d—–w c:\documents and settings\All Users\Application Data\NOS
2008-10-03 19:23 ——— d—–w c:\program files\Common Files\Adobe AIR
2008-10-02 18:21 ——— d—–w c:\program files\UserTesting.com
2008-10-02 18:21 ——— d—–w c:\documents and settings\Karla\Application Data\TestingRecorder
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Sonic
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Leadertech
2008-10-02 02:14 ——— d—–w c:\documents and settings\All Users\Application Data\WinZip
2008-10-02 02:05 ——— d—–w c:\program files\Google
2008-01-14 02:30 3,006,976 –sha-w c:\program files\ehthumbs.db
.

((((((((((((((((((((((((((((( snapshot@2008-11-30_17.04.00.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-12-01 01:36:15 3,948,544 —-a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:15 262,144 —-a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-12-01 01:36:14 3,948,544 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:14 262,144 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-11-30 21:45:55 66,486 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-01 01:47:17 66,888 —-a-w c:\windows\system32\perfc009.dat
- 2008-11-30 21:45:55 417,048 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-01 01:47:17 417,616 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
c:\program files\AnvTrgrsoftware\AnvTrgrWarning.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"com.codeode.cactusspamfilter"="c:\program files\Cactus Spam Filter 2.13\cactusspamfilter.exe" [2006-04-30 749568]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-11 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-27 7585792]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
"nwiz"="nwiz.exe" [2006-09-27 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-01 c:\windows\system32\CHDAudPropShortcut.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{4d5b7736-a3bc-4e5b-9fa2-1bcc3e587abb}"= "c:\windows\system32\cwegus.dll" [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnvTrgr]
c:\program files\AnvTrgrsoftware\AnvTrgr.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Movie Maker\\moviemk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 NEOFLTR_550_12415;Juniper Networks TDI Filter Driver (NEOFLTR_550_12415);\??\c:\windows\system32\Drivers\NEOFLTR_550_12415.SYS [2007-12-07 63008]
S2 COM+ System Application (COMSysApp) ;COM+ System Application (COMSysApp) ;c:\program files\tinyproxy\tinyproxy.exe []
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys [2006-06-06 61952]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
.
Contents of the 'Scheduled Tasks' folder

2008-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 18:51:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\msdtc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2008-12-01 18:54:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-01 23:53:48
ComboFix2.txt 2008-12-01 03:13:14
ComboFix3.txt 2008-11-30 22:41:49

Pre-Run: 33,149,759,488 bytes free
Post-Run: 32,052,695,040 bytes free

1732 — E O F — 2008-11-13 01:11:30

Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 3

12/1/2008 7:00:05 PM
mbam-log-2008-12-01 (19-00-05).txt

Scan type: Quick Scan
Objects scanned: 50824
Time elapsed: 3 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:00:33 PM, on 12/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AnvTrgrWarningBHO Class - {95E9BCC0-2E84-4500-8A9C-0B7A96769124} - C:\Program Files\AnvTrgrsoftware\AnvTrgrWarning.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://linksyssupport.webex.com/client/T26…ort/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://webvpn.jpmorganchase.com/dana-cache…perSetupSP1.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O22 - SharedTaskScheduler: evacuative - {4d5b7736-a3bc-4e5b-9fa2-1bcc3e587abb} - C:\WINDOWS\system32\cwegus.dll (file missing)
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 11574 bytes

Tomk

Post #8December 2, 2008, 1:53 AM UTC

Craymo1,

Disable your protection programs as we did before. Please do everything in Normal mode.

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
  O2 - BHO: AnvTrgrWarningBHO Class - {95E9BCC0-2E84-4500-8A9C-0B7A96769124} - C:\Program Files\AnvTrgrsoftware\AnvTrgrWarning.dll (file missing)
  O22 - SharedTaskScheduler: evacuative - {4d5b7736-a3bc-4e5b-9fa2-1bcc3e587abb} - C:\WINDOWS\system32\cwegus.dll (file missing)
  O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\Program Files\tinyproxy\tinyproxy.exe (file missing)
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Next

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::

Folder::

Driver::
"COM+ System Application (COMSysApp) "

Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{4d5b7736-a3bc-4e5b-9fa2-1bcc3e587abb}"=-

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

In your next reply please provide:

ComboFix.txt
New HijackThis log taken after everything else completed

Craymo1

Post #9December 2, 2008, 2:34 AM UTC

Ok, ran the above steps. Still seems like same issue, pc running ok but still no internet.

ComboFix 08-11-30.01 - Karla 2008-12-01 21:22:30.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.650 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karla\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_COM+_SYSTEM_APPLICATION_(COMSYSAPP)_
——-\Service_COM+ System Application (COMSysApp)

((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.

2008-11-30 20:37 . 2008-11-30 20:37 578,560 –a—— c:\windows\system32\dllcache\user32.dll
2008-11-30 20:36 . 2008-11-30 20:36 d——– c:\windows\ERUNT
2008-11-30 20:34 . 2008-11-30 20:47 d——– C:\SDFix
2008-11-30 19:57 . 2008-11-30 19:57 d——– c:\documents and settings\All Users\Application Data\Avg8
2008-11-30 19:56 . 2008-11-30 19:56 d——– c:\documents and settings\Karla\Application Data\AVGTOOLBAR
2008-11-30 18:50 . 2008-11-30 18:50 d——– c:\program files\AVG
2008-11-30 18:50 . 2008-11-30 18:50 10,520 ——— c:\windows\system32\avgrsstx.dll.install_backup
2008-11-30 18:26 . 2008-12-01 18:55 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\Karla\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-10-22 16:10 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-30 18:26 . 2008-10-22 16:10 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\Karla\Application Data\muvee Technologies
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\All Users\Application Data\muvee Technologies
2008-11-30 17:00 . 2008-11-30 17:00 d–hs—- C:\found.000
2008-11-30 16:49 . 2008-11-30 16:49 d——– c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 00:58 ——— d—–w c:\program files\Creative
2008-10-26 13:12 822,272 —-a-w c:\windows\system32\drivers\BCMWL5.SYS
2008-10-26 13:12 ——— d—–w c:\documents and settings\Karla\Application Data\InstallShield
2008-10-26 04:11 ——— d—–w c:\documents and settings\Karla\Application Data\GTek
2008-10-26 04:07 ——— d—–w c:\program files\Broadcom
2008-10-21 11:43 ——— d—–w c:\program files\BigLots
2008-10-04 01:02 ——— d—–w c:\program files\NOS
2008-10-04 01:02 ——— d—–w c:\documents and settings\All Users\Application Data\NOS
2008-10-03 19:23 ——— d—–w c:\program files\Common Files\Adobe AIR
2008-10-02 18:21 ——— d—–w c:\program files\UserTesting.com
2008-10-02 18:21 ——— d—–w c:\documents and settings\Karla\Application Data\TestingRecorder
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Sonic
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Leadertech
2008-10-02 02:14 ——— d—–w c:\documents and settings\All Users\Application Data\WinZip
2008-10-02 02:05 ——— d—–w c:\program files\Google
2008-01-14 02:30 3,006,976 –sha-w c:\program files\ehthumbs.db
.

((((((((((((((((((((((((((((( snapshot@2008-11-30_17.04.00.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-12-01 01:36:15 3,948,544 —-a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:15 262,144 —-a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-12-01 01:36:14 3,948,544 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:14 262,144 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-11-30 21:45:55 66,486 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-01 23:55:28 67,406 —-a-w c:\windows\system32\perfc009.dat
- 2008-11-30 21:45:55 417,048 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-01 23:55:28 418,492 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"com.codeode.cactusspamfilter"="c:\program files\Cactus Spam Filter 2.13\cactusspamfilter.exe" [2006-04-30 749568]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-11 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-27 7585792]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
"nwiz"="nwiz.exe" [2006-09-27 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-01 c:\windows\system32\CHDAudPropShortcut.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnvTrgr]
c:\program files\AnvTrgrsoftware\AnvTrgr.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Movie Maker\\moviemk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 NEOFLTR_550_12415;Juniper Networks TDI Filter Driver (NEOFLTR_550_12415);\??\c:\windows\system32\Drivers\NEOFLTR_550_12415.SYS [2007-12-07 63008]
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys [2006-06-06 61952]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
S4 COM+ System Application (COMSysApp) ;COM+ System Application (COMSysApp) ;c:\program files\tinyproxy\tinyproxy.exe []
.
Contents of the 'Scheduled Tasks' folder

2008-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 21:26:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\msdtc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\dllhost.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2008-12-01 21:29:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-02 02:28:53
ComboFix2.txt 2008-12-01 23:54:22
ComboFix3.txt 2008-12-01 03:13:14
ComboFix4.txt 2008-11-30 22:41:49

Pre-Run: 32,097,116,160 bytes free
Post-Run: 32,078,499,840 bytes free

174 — E O F — 2008-11-13 01:11:30

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:30:00 PM, on 12/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://linksyssupport.webex.com/client/T26…ort/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://webvpn.jpmorganchase.com/dana-cache…perSetupSP1.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 10827 bytes

Tomk

Post #10December 2, 2008, 3:10 AM UTC

Craymo1,

In Internet Explorer: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Next

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
driver::
COM+ System Application (COMSysApp) 
"COM+ System Application (COMSysApp) "
COM+ System Application (COMSysApp)_
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Craymo1

Post #11December 2, 2008, 3:48 AM UTC

Whew, looks like that did the trick! Posting this from the laptop with the issue now. Everyhting seems to be working ok now. Logs below, thanks a lot for your help!

ComboFix 08-12-01.01 - Karla 2008-12-01 22:36:30.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.611 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karla\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_COM+ System Application (COMSysApp)

((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.

2008-11-30 20:37 . 2008-11-30 20:37 578,560 –a—— c:\windows\system32\dllcache\user32.dll
2008-11-30 20:36 . 2008-11-30 20:36 d——– c:\windows\ERUNT
2008-11-30 20:34 . 2008-11-30 20:47 d——– C:\SDFix
2008-11-30 19:57 . 2008-11-30 19:57 d——– c:\documents and settings\All Users\Application Data\Avg8
2008-11-30 19:56 . 2008-11-30 19:56 d——– c:\documents and settings\Karla\Application Data\AVGTOOLBAR
2008-11-30 18:50 . 2008-11-30 18:50 d——– c:\program files\AVG
2008-11-30 18:50 . 2008-11-30 18:50 10,520 ——— c:\windows\system32\avgrsstx.dll.install_backup
2008-11-30 18:26 . 2008-12-01 18:55 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\Karla\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-10-22 16:10 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-30 18:26 . 2008-10-22 16:10 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\Karla\Application Data\muvee Technologies
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\All Users\Application Data\muvee Technologies
2008-11-30 17:00 . 2008-11-30 17:00 d–hs—- C:\found.000
2008-11-30 16:49 . 2008-11-30 16:49 d——– c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 00:58 ——— d—–w c:\program files\Creative
2008-10-26 13:12 822,272 —-a-w c:\windows\system32\drivers\BCMWL5.SYS
2008-10-26 13:12 ——— d—–w c:\documents and settings\Karla\Application Data\InstallShield
2008-10-26 04:11 ——— d—–w c:\documents and settings\Karla\Application Data\GTek
2008-10-26 04:07 ——— d—–w c:\program files\Broadcom
2008-10-21 11:43 ——— d—–w c:\program files\BigLots
2008-10-04 01:02 ——— d—–w c:\program files\NOS
2008-10-04 01:02 ——— d—–w c:\documents and settings\All Users\Application Data\NOS
2008-10-03 19:23 ——— d—–w c:\program files\Common Files\Adobe AIR
2008-10-02 18:21 ——— d—–w c:\program files\UserTesting.com
2008-10-02 18:21 ——— d—–w c:\documents and settings\Karla\Application Data\TestingRecorder
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Sonic
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Leadertech
2008-10-02 02:14 ——— d—–w c:\documents and settings\All Users\Application Data\WinZip
2008-10-02 02:05 ——— d—–w c:\program files\Google
2008-01-14 02:30 3,006,976 –sha-w c:\program files\ehthumbs.db
.

((((((((((((((((((((((((((((( snapshot@2008-11-30_17.04.00.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-12-01 01:36:15 3,948,544 —-a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:15 262,144 —-a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-12-01 01:36:14 3,948,544 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:14 262,144 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-11-30 21:45:55 66,486 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-01 23:55:28 67,406 —-a-w c:\windows\system32\perfc009.dat
- 2008-11-30 21:45:55 417,048 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-01 23:55:28 418,492 —-a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"com.codeode.cactusspamfilter"="c:\program files\Cactus Spam Filter 2.13\cactusspamfilter.exe" [2006-04-30 749568]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-11 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-27 7585792]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
"nwiz"="nwiz.exe" [2006-09-27 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-01 c:\windows\system32\CHDAudPropShortcut.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnvTrgr]
c:\program files\AnvTrgrsoftware\AnvTrgr.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Movie Maker\\moviemk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 NEOFLTR_550_12415;Juniper Networks TDI Filter Driver (NEOFLTR_550_12415);\??\c:\windows\system32\Drivers\NEOFLTR_550_12415.SYS [2007-12-07 63008]
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys [2006-06-06 61952]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
S4 COM+ System Application (COMSysApp) ;COM+ System Application (COMSysApp) ;c:\program files\tinyproxy\tinyproxy.exe []
.
Contents of the 'Scheduled Tasks' folder

2008-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 22:39:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\windows\system32\msdtc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\mqsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2008-12-01 22:42:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-02 03:42:01
ComboFix2.txt 2008-12-02 02:29:24
ComboFix3.txt 2008-12-01 23:54:22
ComboFix4.txt 2008-12-01 03:13:14
ComboFix5.txt 2008-12-02 03:35:51

Pre-Run: 32,087,486,464 bytes free
Post-Run: 32,069,783,552 bytes free

174 — E O F — 2008-11-13 01:11:30

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:43:28 PM, on 12/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://linksyssupport.webex.com/client/T26…ort/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://webvpn.jpmorganchase.com/dana-cache…perSetupSP1.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 10698 bytes

Tomk

Post #12December 2, 2008, 4:06 AM UTC

Craymo1,

Please open Notepad.
Copy and Paste everything from the Quote box into Notepad:

@Echo off
sc stop "COM+ System Application (COMSysApp) "
sc delete "COM+ System Application (COMSysApp) "
del delete.bat

Save the file to your DESKTOP as "delete.bat". Make sure to save it with the quotes. Once saved, the icon to click should look like this on your desktop:[external image: Posted Image]
Double click delete.bat.

Then

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

In your next reply please provide:

Kaspersky report
New HijackThis log taken after everything else completed

Craymo1

Post #13December 2, 2008, 1:00 PM UTC

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, December 2, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, December 02, 2008 02:36:19
Records in database: 1430824
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 76268
Threat name: 1
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 01:45:49

File name / Threat name / Threats count
C:\Documents and Settings\Karla\My Documents\My Music\get up quietdrive.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\Karla\My Documents\My Music\when first unto jerry garcia.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:57:30 AM, on 12/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Karla\Local Settings\Temp\jkos-Karla\binaries\ScanningProcess.exe
C:\Documents and Settings\Karla\Local Settings\Temp\jkos-Karla\binaries\ScanningProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://linksyssupport.webex.com/client/T26…ort/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://webvpn.jpmorganchase.com/dana-cache…perSetupSP1.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 11637 bytes

Tomk

Post #14December 2, 2008, 1:08 PM UTC

Craymo1,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

file::
C:\Documents and Settings\Karla\My Documents\My Music\get up quietdrive.mp3
C:\Documents and Settings\Karla\My Documents\My Music\when first unto jerry garcia.mp3

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 11…allows end-users to run Java applications".
Click the "Download" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are three options in the window to clear the cache - Leave all 3 Checked
- Downloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

Then please give me (hopefully) one last HijackThis log.

Craymo1

Post #15December 2, 2008, 1:40 PM UTC

Ok, lets see if this does it.

ComboFix 08-12-01.01 - Karla 2008-12-02 8:14:24.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.590 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Karla\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\documents and settings\Karla\My Documents\My Music\get up quietdrive.mp3
c:\documents and settings\Karla\My Documents\My Music\when first unto jerry garcia.mp3
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Karla\My Documents\My Music\get up quietdrive.mp3

.
((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.

2008-12-01 23:08 . 2008-12-01 23:10 d——– c:\windows\system32\drivers\Avg
2008-12-01 23:08 . 2008-12-01 23:08 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2008-12-01 23:08 . 2008-12-01 23:08 10,520 –a—— c:\windows\system32\avgrsstx.dll
2008-11-30 20:37 . 2008-11-30 20:37 578,560 –a—— c:\windows\system32\dllcache\user32.dll
2008-11-30 20:36 . 2008-11-30 20:36 d——– c:\windows\ERUNT
2008-11-30 20:34 . 2008-11-30 20:47 d——– C:\SDFix
2008-11-30 19:57 . 2008-12-01 23:07 d——– c:\documents and settings\All Users\Application Data\Avg8
2008-11-30 19:56 . 2008-12-02 08:13 d——– c:\documents and settings\Karla\Application Data\AVGTOOLBAR
2008-11-30 18:50 . 2008-11-30 18:50 d——– c:\program files\AVG
2008-11-30 18:50 . 2008-11-30 18:50 10,520 ——— c:\windows\system32\avgrsstx.dll.install_backup
2008-11-30 18:26 . 2008-12-01 18:55 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\Karla\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-11-30 18:26 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-30 18:26 . 2008-10-22 16:10 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-30 18:26 . 2008-10-22 16:10 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\Karla\Application Data\muvee Technologies
2008-11-30 17:51 . 2008-11-30 17:51 d——– c:\documents and settings\All Users\Application Data\muvee Technologies
2008-11-30 17:00 . 2008-11-30 17:00 d–hs—- C:\found.000
2008-11-30 16:49 . 2008-11-30 16:49 d——– c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-02 03:47 ——— d—–w c:\program files\Microsoft Silverlight
2008-12-01 00:58 ——— d—–w c:\program files\Creative
2008-10-26 13:12 822,272 —-a-w c:\windows\system32\drivers\BCMWL5.SYS
2008-10-26 13:12 ——— d—–w c:\documents and settings\Karla\Application Data\InstallShield
2008-10-26 04:11 ——— d—–w c:\documents and settings\Karla\Application Data\GTek
2008-10-26 04:07 ——— d—–w c:\program files\Broadcom
2008-10-21 11:43 ——— d—–w c:\program files\BigLots
2008-10-15 16:34 337,408 —-a-w c:\windows\system32\dllcache\netapi32.dll
2008-10-04 01:02 ——— d—–w c:\program files\NOS
2008-10-04 01:02 ——— d—–w c:\documents and settings\All Users\Application Data\NOS
2008-10-03 19:23 ——— d—–w c:\program files\Common Files\Adobe AIR
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-10-02 18:21 ——— d—–w c:\program files\UserTesting.com
2008-10-02 18:21 ——— d—–w c:\documents and settings\Karla\Application Data\TestingRecorder
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Sonic
2008-10-02 15:57 ——— d—–w c:\documents and settings\Karla\Application Data\Leadertech
2008-10-02 02:14 ——— d—–w c:\documents and settings\All Users\Application Data\WinZip
2008-10-02 02:05 ——— d—–w c:\program files\Google
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\dllcache\win32k.sys
2008-09-08 10:41 333,824 ——w c:\windows\system32\dllcache\srv.sys
2008-01-14 02:30 3,006,976 –sha-w c:\program files\ehthumbs.db
.

((((((((((((((((((((((((((((( snapshot@2008-11-30_17.04.00.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2008-12-01 01:36:15 3,948,544 —-a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:15 262,144 —-a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 —-a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-12-01 01:36:14 3,948,544 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-12-01 01:36:14 262,144 —-a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2008-12-02 04:08:05 26,824 —-a-w c:\windows\system32\drivers\avgmfx86.sys
- 2008-11-30 21:45:55 66,486 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-01 23:55:28 67,406 —-a-w c:\windows\system32\perfc009.dat
- 2008-11-30 21:45:55 417,048 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-01 23:55:28 418,492 —-a-w c:\windows\system32\perfh009.dat
+ 2006-12-02 03:56:00 96,256 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-02 05:25:52 1,101,824 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 05:25:56 1,093,120 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 05:25:58 69,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 05:26:00 57,856 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 05:08:00 40,960 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 05:08:00 45,056 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 05:08:00 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 05:08:00 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 05:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 05:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 05:08:00 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 05:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 05:08:00 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 05:46:44 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"com.codeode.cactusspamfilter"="c:\program files\Cactus Spam Filter 2.13\cactusspamfilter.exe" [2006-04-30 749568]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-11 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-27 7585792]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-01 1234712]
"nwiz"="nwiz.exe" [2006-09-27 c:\windows\system32\nwiz.exe]
"MsmqIntCert"="mqrt.dll" [2008-04-13 c:\windows\system32\mqrt.dll]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-01 c:\windows\system32\CHDAudPropShortcut.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnvTrgr]
c:\program files\AnvTrgrsoftware\AnvTrgr.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Movie Maker\\moviemk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-01 97928]
R1 NEOFLTR_550_12415;Juniper Networks TDI Filter Driver (NEOFLTR_550_12415);\??\c:\windows\system32\Drivers\NEOFLTR_550_12415.SYS [2007-12-07 63008]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-01 231704]
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\Drivers\5U870CAP.sys [2006-06-06 61952]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-01 29744]

*Newly Created Service* - AVG8WD
*Newly Created Service* - AVGLDX86
*Newly Created Service* - AVGMFX86
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-02 08:16:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????
scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-02 8:17:25
ComboFix-quarantined-files.txt 2008-12-02 13:17:13
ComboFix2.txt 2008-12-02 03:42:34
ComboFix3.txt 2008-12-02 02:29:24
ComboFix4.txt 2008-12-01 23:54:22
ComboFix5.txt 2008-12-02 13:13:37

Pre-Run: 31,959,138,304 bytes free
Post-Run: 32,000,753,664 bytes free

184 — E O F — 2008-11-13 01:11:30

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:38:12 AM, on 12/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.expresstoolie.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import ActiveX Control) - http://www2.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://linksyssupport.webex.com/client/T26…ort/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://webvpn.jpmorganchase.com/dana-cache…perSetupSP1.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 11661 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] No internet and no executables work

✨ Ask AI

Ask AI