Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

HELP ME! trojandownloader.xs [RESOLVED]

Started by helpme? , Apr 21 2008 10:56 PM

This topic is locked

#1
helpme?

Posted 21 April 2008 - 10:56 PM

Member

Member
46 posts

help i have it and dont know how to get rid of it help me please

Edited by helpme?, 21 April 2008 - 10:57 PM.

#2
Essexboy

Posted 22 April 2008 - 01:29 PM

GeekU Moderator

Retired Staff
69,964 posts

Before I can help you I need to know what the problem is

Download & Run HijackThis.exe

Download HJTInstall.exe to your Desktop.
Doubleclick HJTInstall.exe to install it.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Copy/Paste the log to your next reply please.

Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

#3
helpme?

Posted 22 April 2008 - 02:00 PM

Member

Topic Starter
Member
46 posts

HERE IT IS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:02 AM, on 4/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wmsdkns.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Acount Of Death\My Documents\HiJackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wmsdkns.exe,
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [] Rundll32.exe "C:\WINDOWS\system32\bucfhxeo.dll",s
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1075156122312
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zon...ro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab57176.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopet...v/GoPetsWeb.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 4668 bytes

#4
Essexboy

Posted 22 April 2008 - 03:52 PM

GeekU Moderator

Retired Staff
69,964 posts

Hi there two things I have noticed straight off

1. You have no anti-virus
2. Your Java is a few years out of date

First priority is to secure your system

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) 6 Update 6 and save it to your desktop.
Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 6...allows end-users to run Java applications".
Click the "Download" button to the right.
Read the License Agreement and then check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.

THEN

Next you have to download an antivirus. This program is basic for the security of your computer and in todays age not having one will probably lead to disaster for your computer.

Please go HERE and download avast! 4 Home Edition to your desktop. Locate the file that you just downloaded, double-click on the file to launch the installation of avast!

Click Next on the avast! Setup window and on the next window with the ReadMe File.
Now you will see the Legal Agreement, just click I agree, and then click Next to continue.

You will be prompted with Configuration window, make sure that you choose Typical configuration and then click Next. Click Next to the windows that will follow, when the installation will finish, you will be given an option to schedule a boot time scan, select No

Now you have to restart your machine, select Restart and then click Finish.

After you restart you will get a message about avast! it will give you the general "Hello and Thank you for choosing our Product." Also after you restart you will notice 2 new icons in the bottom right corner of the screen.

VERY IMPORTANT - after restarting, right click on the a in the taskbar and select Updating, then highlight and click Program.

You will get popup after its done updating. If avast! had to download anything for your computer you may get a message asking you to restart.

After you have updated avast! right click the small icon a in task bar and click Start Avast! AntiVirus

Click Program Registration and you will be taken to their website. Fill out the form and then check you e-mail. Once you get an e-mail from them (usually about 1 minute after submitting the form) copy and paste the serial they provided into the highlighted box. Then click ok.

After this, you will need to Schedule Boot-Time Scan with avast! Click on the little button placed up in the left corner, and select Schedule Boot-Time Scan. Read also this tutorial HERE it may make it easier to you to follow the steps.

Next, choose

Scan all local disks
scan archive files
click on Schedule

On the next dialog Operating system restart needed select Yes
Now avast! will restart your computer and start to scan before Windows fully loads.

IMPORTANT NOTE since your system has infections on it, avast! will give you dialog box with recommended actions, and options, please make sure if this happens, to click the Move to Chest button, and not to delete any reported files.

The boot log will be located here C:\Program Files\Alwil Software\Avast4\DATA\report\AswBoot.txt

ONCE YOU HAVE DONE THAT

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wmsdkns.exe,
O4 - HKLM\..\Run: [] Rundll32.exe "C:\WINDOWS\system32\bucfhxeo.dll",s

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

FINALLY FOR NOW

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
C:\WINDOWS\system32\wmsdkns.exe
C:\WINDOWS\system32\bucfhxeo.dll
Purity
```
Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Logs required : ASWBoot.txt, OTMoveit and a new Hijackthis

#5
helpme?

Posted 23 April 2008 - 03:53 AM

Member

Topic Starter
Member
46 posts

HERE YOU GO

C:\WINDOWS\system32\wmsdkns.exe moved successfully.
File/Folder C:\WINDOWS\system32\bucfhxeo.dll not found.
< Purity >
C:\WINDOWS\Fоnts\Fоnts moved successfully.
C:\WINDOWS\Fоnts moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04232008_025209

#6
Essexboy

Posted 23 April 2008 - 01:14 PM

GeekU Moderator

Retired Staff
69,964 posts

Could I have a new Hijackthis log with the ASWBoot.txt - And how is your computer now ?

#7
helpme?

Posted 23 April 2008 - 07:19 PM

Member

Topic Starter
Member
46 posts

it says i have spyware and my security could be at risk and stuff still

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:09:37 PM, on 4/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\wmsdkns.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Acount Of Death\My Documents\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.geekstogo...xs-t195708.html
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\wmsdkns.exe,
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
O2 - BHO: (no name) - {A8EEB996-62AA-4E48-995D-EADDCAC47476} - C:\WINDOWS\system32\byXNgheF.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {ABB68206-5154-47D3-ABC5-611C1658ABA0} - (no file)
O2 - BHO: (no name) - {C1E79391-E004-4FC1-A43E-626075104CEA} - C:\WINDOWS\system32\rqRHwTmm.dll (file missing)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {fb72365d-a66c-4e0a-a342-3e317ff8bd2e} - (no file)
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O2 - BHO: (no name) - {FD91C548-D99E-4C63-B615-1F6E5506C0FC} - C:\WINDOWS\system32\mljgh.dll (file missing)
O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [] Rundll32.exe "C:\WINDOWS\system32\bucfhxeo.dll",s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BM078481a4] Rundll32.exe "C:\WINDOWS\system32\rvtrxcuh.dll",s
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1075156122312
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zon...ro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab57176.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopet...v/GoPetsWeb.cab
O20 - Winlogon Notify: byXNgheF - byXNgheF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 8281 bytes

Edited by helpme?, 23 April 2008 - 10:10 PM.

#8
Essexboy

Posted 24 April 2008 - 01:40 PM

GeekU Moderator

Retired Staff
69,964 posts

It looks like re-inforcements were downloaded before the antivirus was installed - so lets kill them now

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\wmsdkns.exe,
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
O2 - BHO: (no name) - {A8EEB996-62AA-4E48-995D-EADDCAC47476} - C:\WINDOWS\system32\byXNgheF.dll (file missing)
O2 - BHO: (no name) - {ABB68206-5154-47D3-ABC5-611C1658ABA0} - (no file)
O2 - BHO: (no name) - {C1E79391-E004-4FC1-A43E-626075104CEA} - C:\WINDOWS\system32\rqRHwTmm.dll (file missing)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {fb72365d-a66c-4e0a-a342-3e317ff8bd2e} - (no file)
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O2 - BHO: (no name) - {FD91C548-D99E-4C63-B615-1F6E5506C0FC} - C:\WINDOWS\system32\mljgh.dll (file missing)
O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
O4 - HKLM\..\Run: [] Rundll32.exe "C:\WINDOWS\system32\bucfhxeo.dll",s
O4 - HKLM\..\Run: [BM078481a4] Rundll32.exe "C:\WINDOWS\system32\rvtrxcuh.dll",s
O20 - Winlogon Notify: byXNgheF - byXNgheF.dll (file missing)

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

NEXT

Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

C:\WINDOWS\system32\wmsdkns.exe
C:\WINDOWS\system32\byXNgheF.dll 
C:\WINDOWS\system32\rqRHwTmm.dll 
C:\WINDOWS\system32\mljgh.dll 
C:\WINDOWS\system32\bucfhxeo.dll
C:\WINDOWS\system32\rvtrxcuh.dll
Purity

Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY FOR NOW

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  -----------------------------------------------------------
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
-----------------------------------------------------------
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

#9
helpme?

Posted 24 April 2008 - 02:54 PM

Member

Topic Starter
Member
46 posts

HERES ***COMBO FIX***

ComboFix 08-04-22.5 - Acount Of Death 2008-04-24 13:27:56.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.252 [GMT -7:00]
Running from: C:\Documents and Settings\Acount Of Death\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\.protected
C:\Program Files\180search assistant
C:\Program Files\180search assistant\180sa.exe
C:\Program Files\180search assistant\sau.exe
C:\Program Files\180searchassistant
C:\Program Files\180searchassistant\saap.exe
C:\Program Files\180searchassistant\sac.exe
C:\Program Files\180solutions
C:\Program Files\180solutions\sais.exe
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\PC-Cleaner
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dicy.gz
C:\Program Files\QdrModule\kwdy.gz
C:\Program Files\QdrModule\QdrModule15.exe
C:\Program Files\seekmo
C:\Program Files\seekmo\seekmohook.dll
C:\Program Files\stc
C:\Program Files\stc\csv5p070.exe
C:\Program Files\Sysmnt
C:\Program Files\Sysmnt\Ssmgr.exe
C:\Program Files\zango
C:\Program Files\zango\zango.exe
C:\WINDOWS\123messenger.per
C:\WINDOWS\180ax.exe
C:\WINDOWS\2020search.dll
C:\WINDOWS\2020search2.dll
C:\WINDOWS\apphelp32.dll
C:\WINDOWS\asferror32.dll
C:\WINDOWS\asycfilt32.dll
C:\WINDOWS\athprxy32.dll
C:\WINDOWS\ati2dvaa32.dll
C:\WINDOWS\ati2dvag32.dll
C:\WINDOWS\audiosrv32.dll
C:\WINDOWS\autodisc32.dll
C:\WINDOWS\avifile32.dll
C:\WINDOWS\avisynthex32.dll
C:\WINDOWS\aviwrap32.dll
C:\WINDOWS\bjam.dll
C:\WINDOWS\bokja.exe
C:\WINDOWS\browserad.dll
C:\WINDOWS\cdsm32.dll
C:\WINDOWS\changeurl_30.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\default.htm
C:\WINDOWS\didduid.ini
C:\WINDOWS\FLEOK
C:\WINDOWS\FLEOK\180ax.exe
C:\WINDOWS\inf\ultra.inf
C:\WINDOWS\Installer\id53.exe
C:\WINDOWS\licencia.txt
C:\WINDOWS\msa64chk.dll
C:\WINDOWS\msapasrc.dll
C:\WINDOWS\mspphe.dll
C:\WINDOWS\mssvr.exe
C:\WINDOWS\ntnut.exe
C:\WINDOWS\PerfInfo
C:\WINDOWS\PerfInfo\hWKFUyglYQwp.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\saiemod.dll
C:\WINDOWS\salm.exe
C:\WINDOWS\shdocpe.dll
C:\WINDOWS\shdocpl.dll
C:\WINDOWS\stcloader.exe
C:\WINDOWS\swin32.dll
C:\WINDOWS\system32\000090.exe
C:\WINDOWS\system32\acmsqieo.dll
C:\WINDOWS\system32\aemklexl.ini
C:\WINDOWS\system32\aiyphwvo.ini
C:\WINDOWS\system32\avwdkmxr.dll
C:\WINDOWS\system32\axdemthd.dll
C:\WINDOWS\system32\baeahlxa.ini
C:\WINDOWS\system32\bfswkdun.ini
C:\WINDOWS\system32\bgrkkvqh.dll
C:\WINDOWS\system32\bladplvx.ini
C:\WINDOWS\system32\brlmxfnv.dll
C:\WINDOWS\system32\bvmpbmre.ini
C:\WINDOWS\system32\ceemrvow.ini
C:\WINDOWS\system32\cwhqbvxs.ini
C:\WINDOWS\system32\drivers\etc\.protected
C:\WINDOWS\system32\dsgdarmd.ini
C:\WINDOWS\system32\dwkulmuu.dll
C:\WINDOWS\system32\ebyralfi.ini
C:\WINDOWS\system32\ectqgnhb.ini
C:\WINDOWS\system32\efownsqh.ini
C:\WINDOWS\system32\eovkxdci.ini
C:\WINDOWS\system32\eqfwgrlk.ini
C:\WINDOWS\system32\eqpaxjce.dll
C:\WINDOWS\system32\gcxsubng.ini
C:\WINDOWS\system32\gdenjokc.ini
C:\WINDOWS\system32\gjjlm.ini
C:\WINDOWS\system32\gjjlm.ini2
C:\WINDOWS\system32\gqnowglc.ini
C:\WINDOWS\system32\gtsjvdel.ini
C:\WINDOWS\system32\gwagslfi.ini
C:\WINDOWS\system32\hclxxndt.ini
C:\WINDOWS\system32\hgjlm.ini
C:\WINDOWS\system32\hgjlm.ini2
C:\WINDOWS\system32\hgvijgtu.ini
C:\WINDOWS\system32\hjhxhuny.ini
C:\WINDOWS\system32\hqvkkrgb.ini
C:\WINDOWS\system32\ifqoajon.ini
C:\WINDOWS\system32\ijxmogoc.ini
C:\WINDOWS\system32\jksbhwnp.ini
C:\WINDOWS\system32\jqwqgkqn.ini
C:\WINDOWS\system32\kesgvpim.ini
C:\WINDOWS\system32\lvfkrrwm.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mmTwHRqr.ini
C:\WINDOWS\system32\mmTwHRqr.ini2
C:\WINDOWS\system32\msixu.dll
C:\WINDOWS\system32\MSNSA32.dll
C:\WINDOWS\system32\natxwrkf.ini
C:\WINDOWS\system32\ntnut32.exe
C:\WINDOWS\system32\obrhnnjd.ini
C:\WINDOWS\system32\ojmvupsj.ini
C:\WINDOWS\system32\onxensbk.ini
C:\WINDOWS\system32\oxydqnan.ini
C:\WINDOWS\system32\pmxqampb.ini
C:\WINDOWS\system32\pwvcupdj.ini
C:\WINDOWS\system32\qtkofcdn.ini
C:\WINDOWS\system32\rcsyhwyf.ini
C:\WINDOWS\system32\rncmqtrm.ini
C:\WINDOWS\system32\rnsjgwqe.dll
C:\WINDOWS\system32\rouksfnt.ini
C:\WINDOWS\system32\rqtss.ini
C:\WINDOWS\system32\rqtss.ini2
C:\WINDOWS\system32\rxmkdwva.ini
C:\WINDOWS\system32\sgxyenmw.ini
C:\WINDOWS\system32\shdocpe.dll
C:\WINDOWS\system32\SIPSPI32.dll
C:\WINDOWS\system32\sxwjkpqw.dll
C:\WINDOWS\system32\tnfskuor.dll
C:\WINDOWS\system32\tpvtdlpr.ini
C:\WINDOWS\system32\uabajewa.dll
C:\WINDOWS\system32\veyymyfg.ini
C:\WINDOWS\system32\vfentvpf.dll
C:\WINDOWS\system32\vjadogcq.ini
C:\WINDOWS\system32\vxykjolg.ini
C:\WINDOWS\system32\vyfeotli.ini
C:\WINDOWS\system32\wer8274.dll
C:\WINDOWS\system32\wgshiegq.ini
C:\WINDOWS\system32\xfsjiyoe.ini
C:\WINDOWS\system32\xnfmgttu.ini
C:\WINDOWS\system32\xxlgprkp.ini
C:\WINDOWS\telefonos.txt
C:\WINDOWS\TEMP\salm.exe
C:\WINDOWS\textos.txt
C:\WINDOWS\updatetc.exe
C:\WINDOWS\voiceip.dll
C:\WINDOWS\winsb.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Legacy_SZKG5

((((((((((((((((((((((((( Files Created from 2008-03-24 to 2008-04-24 )))))))))))))))))))))))))))))))
.

2008-04-24 13:35 . 2008-04-24 13:38 <DIR> d-------- C:\WINDOWS\FLEOK
2008-04-24 13:35 . 2008-04-24 13:38 <DIR> d-------- C:\Program Files\zango
2008-04-24 13:35 . 2008-04-24 13:39 <DIR> d-------- C:\Program Files\Sysmnt
2008-04-24 13:35 . 2008-04-24 13:38 <DIR> d-------- C:\Program Files\stc
2008-04-24 13:35 . 2008-04-24 13:39 <DIR> d-------- C:\Program Files\seekmo
2008-04-24 13:35 . 2008-04-24 13:38 <DIR> d-------- C:\Program Files\180solutions
2008-04-24 13:35 . 2008-04-24 13:38 <DIR> d-------- C:\Program Files\180searchassistant
2008-04-24 13:35 . 2008-04-24 13:38 <DIR> d-------- C:\Program Files\180search assistant
2008-04-23 02:52 . 2008-04-23 02:52 <DIR> d-------- C:\_OTMoveIt
2008-04-23 00:41 . 2008-04-23 02:18 <DIR> d-------- C:\Documents and Settings\Acount Of Death\Contacts
2008-04-22 23:52 . 2008-04-22 23:52 268 --ah----- C:\sqmdata03.sqm
2008-04-22 23:52 . 2008-04-22 23:52 244 --ah----- C:\sqmnoopt03.sqm
2008-04-22 23:35 . 2008-04-22 23:37 <DIR> d-------- C:\Program Files\MSN Messenger
2008-04-22 23:11 . 2008-04-22 23:11 <DIR> d-------- C:\Program Files\Alwil Software
2008-04-22 21:56 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-22 21:44 . 2008-04-22 21:51 <DIR> d-------- C:\Program Files\Java
2008-04-22 21:43 . 2008-04-22 21:43 <DIR> d-------- C:\Program Files\Common Files\Java
2008-04-21 04:31 . 2008-04-21 04:35 1,540,677 ---hs---- C:\WINDOWS\system32\huiekufa.ini
2008-04-20 12:46 . 2008-04-20 12:47 1,541,261 ---hs---- C:\WINDOWS\system32\ekpgmtja.ini
2008-04-19 07:27 . 2008-04-21 23:08 <DIR> d---s---- C:\Documents and Settings\Acount Of Death\UserData
2008-04-19 04:41 . 2008-04-20 04:41 1,541,201 ---hs---- C:\WINDOWS\system32\xaxsrdia.ini
2008-04-17 22:11 . 2008-04-17 22:11 <DIR> d--h----- C:\WINDOWS\PIF
2008-04-15 21:16 . 2008-04-15 22:27 1,602,653 ---hs---- C:\WINDOWS\system32\bmottasd.ini
2008-04-15 06:59 . 2008-04-24 13:40 <DIR> d-------- C:\Documents and Settings\Acount Of Death\Shared
2008-04-15 06:59 . 2008-04-24 13:41 <DIR> d-------- C:\Documents and Settings\Acount Of Death\Incomplete
2008-04-15 06:58 . 2008-04-17 03:37 <DIR> d-------- C:\Documents and Settings\Acount Of Death\Application Data\LimeWire
2008-04-15 05:58 . 2008-04-15 06:00 <DIR> d-------- C:\Program Files\WinClamAVShield
2008-04-14 16:44 . 2008-04-24 13:39 <DIR> d-------- C:\Documents and Settings\Acount Of Death\Application Data\Spyware Terminator
2008-04-14 16:43 . 2008-04-24 13:35 <DIR> d-------- C:\Documents and Settings\Acount Of Death
2008-04-14 16:43 . 2008-04-24 13:41 1,024 --ah----- C:\Documents and Settings\Acount Of Death\ntuser.dat.LOG
2008-04-09 20:57 . 2008-04-09 20:57 294 ---hs---- C:\WINDOWS\system32\psoqmvau.ini
2008-04-09 20:12 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-04-09 20:12 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-04-09 20:12 . 2008-03-29 00:19 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-09 20:12 . 2008-04-08 22:44 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-09 20:12 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-04-09 20:12 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-09 20:12 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-09 19:55 . 2008-04-09 19:56 <DIR> d-------- C:\Documents and Settings\Administrator
2008-04-09 19:55 . 2008-04-24 13:27 1,024 --ah----- C:\Documents and Settings\Administrator\ntuser.dat.LOG
2008-04-09 03:03 . 2008-04-09 03:14 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-04-08 02:11 . 2008-04-23 03:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-06 15:32 . 2008-04-06 15:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
2008-04-06 15:13 . 2008-04-07 14:07 <DIR> d-------- C:\Program Files\PC Tools AntiVirus
2008-04-06 15:13 . 2008-04-06 15:13 <DIR> d-------- C:\Program Files\Common Files\PC Tools
2008-04-06 15:13 . 2008-04-06 15:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-04-06 15:13 . 2007-12-06 16:51 28,568 --a------ C:\WINDOWS\system32\drivers\AVHook.sys
2008-04-06 15:13 . 2007-12-06 16:51 21,912 --a------ C:\WINDOWS\system32\drivers\AVRec.sys
2008-04-06 15:13 . 2008-02-12 11:44 21,904 --a------ C:\WINDOWS\system32\drivers\AVFilter.sys
2008-04-06 14:35 . 2008-04-09 13:21 <DIR> d-------- C:\Program Files\STOPzilla!
2008-04-06 14:31 . 2008-04-06 14:31 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-04-06 14:30 . 2008-04-08 02:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-04-06 11:12 . 2008-04-14 16:23 <DIR> d-------- C:\Program Files\Win_Performance
2008-04-06 02:26 . 2008-04-06 02:30 2,951,982 ---hs---- C:\WINDOWS\system32\iacgapma.ini
2008-04-06 02:19 . 2008-04-06 02:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\etsjuryx
2008-04-06 02:19 . 2008-04-06 02:19 67,584 --a------ C:\Documents and Settings\All Users\Application Data\mvkpyfkp.dll
2008-04-06 02:18 . 2008-04-06 02:18 <DIR> d-------- C:\WINDOWS\uprjiefj
2008-04-06 02:18 . 2008-04-06 02:18 182,784 --a------ C:\WINDOWS\hixctiny.dll
2008-04-06 02:18 . 2008-04-06 02:18 106,496 --a------ C:\WINDOWS\system32\elmpwpql.exe
2008-04-06 02:18 . 2008-04-06 02:18 67,584 --a------ C:\WINDOWS\atibejkv.dll
2008-04-06 02:15 . 2008-04-06 02:15 396 --a------ C:\WINDOWS\system32\LF47.tmp
2008-04-06 02:15 . 2008-04-06 02:15 396 --a------ C:\WINDOWS\system32\L1AEF.tmp
2008-04-06 02:15 . 2008-04-06 02:15 396 --a------ C:\WINDOWS\system32\L18AD.tmp
2008-04-06 02:15 . 2008-04-06 02:15 396 --a------ C:\WINDOWS\system32\L11A8.tmp
2008-03-30 01:31 . 2008-03-30 01:31 <DIR> d-------- C:\$WIN_NT$.~BT
2008-03-30 01:31 . 2004-08-04 05:00 472,007 -ra------ C:\txtsetup.sif
2008-03-30 01:31 . 2004-08-04 05:00 260,272 -ra------ C:\$LDR$

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-24 20:39 --------- d-----w C:\Program Files\Spyware Terminator
2008-04-23 07:38 --------- d-----w C:\Program Files\Google
2008-04-23 07:04 --------- d-----w C:\Program Files\E404DHelper
2008-04-22 19:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-04-18 09:56 --------- d-----w C:\Program Files\EA GAMES
2008-04-15 03:47 --------- d-----w C:\Program Files\Opera
2008-04-14 23:07 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-14 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-10 11:10 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-04-07 21:12 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-07 01:32 --------- d-----w C:\Program Files\BitComet
2008-03-27 18:55 --------- d-----w C:\Program Files\DAEMON Tools
2008-03-27 16:28 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-16 18:40 --------- d-sh--w C:\Documents and Settings\All Users\Application Data\MPK
2008-03-12 10:17 --------- d-----w C:\Program Files\knafmhgh
2008-03-12 10:17 --------- d-----w C:\Program Files\Crfcfglp
2008-03-05 11:58 --------- d-----w C:\Program Files\Valve
2008-03-02 08:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-02 05:48 --------- d-----w C:\Program Files\Steam
2008-03-02 05:46 --------- d-----w C:\Program Files\MagicISO
2008-02-28 09:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Earthsim
2008-02-28 09:07 --------- d-----w C:\Program Files\ATI Technologies
2008-02-24 08:25 --------- d-----w C:\Program Files\VstPlugins
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 08:59 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-01-26 09:37 103,277,784 ----a-w C:\Program Files\music_maker_basic_edition_99mb_uk_us_download.exe
2001-11-30 19:09 49,152 -c--a-r C:\Program Files\Common Files\HDvAvi.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-01-19 13:49 4670968]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-04-22 22:03 171448]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-21 16:48 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-21 16:44 126976]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-09-18 13:25 7630848]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-09-18 13:25 86016]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2007-12-12 11:05 2834432]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"BM078481a4"="C:\WINDOWS\system32\rvtrxcuh.dll" [ ]

C:\Documents and Settings\Acount Of Death\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2007-09-17 07:19:14 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.DVSD"= pdvcodec.dll
"vidc.3IV2"= 3ivxVfWCodec_dec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16222:TCP"= 16222:TCP:BitComet 16222 TCP
"16222:UDP"= 16222:UDP:BitComet 16222 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 11:31]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2007-12-12 11:12]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 11:35]
S2 MKEMUSB;Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkemusb.sys [2001-08-08 19:52]
S3 cirrus;cirrus;C:\WINDOWS\system32\DRIVERS\cirrus.sys [2001-08-17 13:57]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkeusbi.sys [2001-12-18 12:38]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-19 19:29:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-24 13:40:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2008-04-24 13:48:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-24 20:47:52

Pre-Run: 2,097,885,184 bytes free
Post-Run: 2,233,851,904 bytes free

350 --- E O F --- 2008-04-24 20:42:34

HERES *HIGHJACK*

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:54:20 PM, on 4/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Acount Of Death\My Documents\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.geekstogo...xs-t195708.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [BM078481a4] Rundll32.exe "C:\WINDOWS\system32\rvtrxcuh.dll",s
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1075156122312
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zon...ro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab57176.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopet...v/GoPetsWeb.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Unknown owner - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 6412 bytes

#10
Essexboy

Posted 24 April 2008 - 03:18 PM

GeekU Moderator

Retired Staff
69,964 posts

Some gone and more to go

Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

C:\Program Files\seekmo
C:\Program Files\180solutions
C:\Program Files\180searchassistant
C:\Program Files\180search assistant
C:\Program Files\zango
C:\Program Files\Sysmnt
C:\Program Files\stc
C:\WINDOWS\FLEOK
C:\WINDOWS\system32\huiekufa.ini
C:\WINDOWS\system32\ekpgmtja.ini
C:\WINDOWS\system32\xaxsrdia.ini
C:\WINDOWS\system32\psoqmvau.ini
C:\WINDOWS\system32\iacgapma.ini
C:\Documents and Settings\All Users\Application Data\etsjuryx
C:\Documents and Settings\All Users\Application Data\mvkpyfkp.dll
C:\WINDOWS\uprjiefj
C:\WINDOWS\hixctiny.dll
C:\WINDOWS\system32\elmpwpql.exe
C:\WINDOWS\atibejkv.dll
C:\WINDOWS\system32\LF47.tmp
C:\WINDOWS\system32\L1AEF.tmp
C:\WINDOWS\system32\L18AD.tmp
C:\WINDOWS\system32\L11A8.tmp
C:\Program Files\E404DHelper
C:\Program Files\knafmhgh
C:\Program Files\Crfcfglp
C:\WINDOWS\system32\rvtrxcuh.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BM078481a4
Purity

Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

NEXT

Download OTScanit to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.

Close ALL OTHER PROGRAMS.
Open the OTScanit folder and double-click on OTScanit.exe to start the program.
Check the box that says Scan All User Accounts
Check the Radio buttons for Files/Folders Created Within 90 Days and Files/Folders Modified Within 90 Days
Under Additional Scans check the following:
- Reg - MountPoints2
- Reg - File - Lop Check
- Reg - Desktop Components
- File - Additional Folder Scans
- File - Purity Scan
Now click the Run Scan button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

To attach a file, do the following:

Click Add Reply
Under the reply panel is the Attachments Panel
Browse for the attachment file you want to upload, then click the green Upload button
Once it has uploaded, click the Manage Current Attachments drop down box
Click on to insert the attachment into your post

#11
helpme?

Posted 24 April 2008 - 03:50 PM

Member

Topic Starter
Member
46 posts

ok the OTmoveit2 thing said everything was moved succecfully
it messed up so i couldent copy it but it said everything was moved

#12
helpme?

Posted 24 April 2008 - 08:34 PM

Member

Topic Starter
Member
46 posts

*******************HERES THE OTHER THING IT GUNNA BE IN PARTS***************

[code=auto:0]
OTScanIt logfile created on: 4/24/2008 2:45:17 PM
OTScanIt by OldTimer - Version 1.0.11.5 Folder = C:\Documents and Settings\Acount Of Death\Desktop\OTScanIt
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 247.39 Mb Available Physical Memory | 48.51% Memory free
863.27 Mb Paging File | 570.30 Mb Available in Paging File | 66.06% Paging File free
Paging file location(s): C:\pagefile.sys 384 768;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 6.10 Gb Free Space | 16.37% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARCEL-506F9F13
Current User Name: Acount Of Death
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users

[Processes - Non-Microsoft Only]
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 17272 bytes | Modified Date = 3/29/2008 11:11:18 AM | Attr = ]
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 144760 bytes | Modified Date = 3/29/2008 11:37:02 AM | Attr = ]
mdnsresponder.exe -> %ProgramFiles%\Bonjour\mDNSResponder.exe -> Apple Computer, Inc. [Ver = 1,0,3,1 | Size = 229376 bytes | Modified Date = 2/28/2006 12:42:38 PM | Attr = ]
sp_rsser.exe -> %ProgramFiles%\Spyware Terminator\sp_rsser.exe -> Crawler.com [Ver = 2.0.1.195 | Size = 984576 bytes | Modified Date = 12/12/2007 11:05:49 AM | Attr = ]
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 247160 bytes | Modified Date = 3/29/2008 11:36:22 AM | Attr = ]
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 345464 bytes | Modified Date = 3/29/2008 11:30:47 AM | Attr = ]
hkcmd.exe -> %SystemRoot%\system32\hkcmd.exe -> Intel Corporation [Ver = 3.0.0.4342 | Size = 126976 bytes | Modified Date = 6/21/2005 4:44:34 PM | Attr = ]
smax4pnp.exe -> %ProgramFiles%\Analog Devices\Core\smax4pnp.exe -> Analog Devices, Inc. [Ver = 5, 2, 0, 5 | Size = 1404928 bytes | Modified Date = 10/14/2004 3:42:54 PM | Attr = ]
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_05\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 144784 bytes | Modified Date = 2/22/2008 4:25:21 AM | Attr = ]
googletoolbarnotifier.exe -> %ProgramFiles%\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 1, 2, 1128, 5462 | Size = 171448 bytes | Modified Date = 4/22/2008 10:03:35 PM | Attr = ]
otscanit.exe -> %UserProfile%\Desktop\OTScanIt\OTScanIt.exe -> OldTimer Tools [Ver = 1.0.11.5 | Size = 370688 bytes | Modified Date = 4/24/2008 4:30:38 AM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 17272 bytes | Modified Date = 3/29/2008 11:11:18 AM | Attr = ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 144760 bytes | Modified Date = 3/29/2008 11:37:02 AM | Attr = ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 247160 bytes | Modified Date = 3/29/2008 11:36:22 AM | Attr = ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 345464 bytes | Modified Date = 3/29/2008 11:30:47 AM | Attr = ]
(Bonjour Service) ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## [Win32_Own | Auto | Running] -> %ProgramFiles%\Bonjour\mDNSResponder.exe -> Apple Computer, Inc. [Ver = 1,0,3,1 | Size = 229376 bytes | Modified Date = 2/28/2006 12:42:38 PM | Attr = ]
(CLTNetCnService) Symantec Lic NetConnect service [Win32_Shared | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\ccSvcHst.exe -> File not found
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %SystemRoot%\system32\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 5:00:00 AM | Attr = ]
(FLEXnet Licensing Service) FLEXnet Licensing Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> File not found
(gusvc) Google Updater Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe -> Google [Ver = 2.0.734.29932.beta | Size = 138168 bytes | Modified Date = 4/22/2008 10:03:20 PM | Attr = ]
(Macromedia Licensing Service) Macromedia Licensing Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Macromedia Shared\Service\Macromedia Licensing.exe -> [Ver = 2.42.000 | Size = 68096 bytes | Modified Date = 12/14/2007 2:23:42 AM | Attr = ]
(sp_rssrv) Spyware Terminator Realtime Shield Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Spyware Terminator\sp_rsser.exe -> Crawler.com [Ver = 2.0.1.195 | Size = 984576 bytes | Modified Date = 12/12/2007 11:05:49 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
BM078481a4 -> %SystemRoot%\system32\rvtrxcuh.DLL [Rundll32.exe "C:\WINDOWS\system32\rvtrxcuh.dll",s] -> File not found
HotKeysCmds -> %SystemRoot%\system32\hkcmd.exe [C:\WINDOWS\system32\hkcmd.exe] -> Intel Corporation [Ver = 3.0.0.4342 | Size = 126976 bytes | Modified Date = 6/21/2005 4:44:34 PM | Attr = ]
IgfxTray -> %SystemRoot%\system32\igfxtray.exe [C:\WINDOWS\system32\igfxtray.exe] -> Intel Corporation [Ver = 3.0.0.4342 | Size = 155648 bytes | Modified Date = 6/21/2005 4:48:18 PM | Attr = ]
NvCplDaemon -> %SystemRoot%\system32\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.9147 | Size = 7630848 bytes | Modified Date = 9/18/2006 1:25:01 PM | Attr = ]
NvMediaCenter -> %SystemRoot%\system32\nvmctray.dll [RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit] -> NVIDIA Corporation [Ver = 6.14.10.9147 | Size = 86016 bytes | Modified Date = 9/18/2006 1:25:07 PM | Attr = ]
SoundMAXPnP -> %ProgramFiles%\Analog Devices\Core\smax4pnp.exe [C:\Program Files\Analog Devices\Core\smax4pnp.exe] -> Analog Devices, Inc. [Ver = 5, 2, 0, 5 | Size = 1404928 bytes | Modified Date = 10/14/2004 3:42:54 PM | Attr = ]
SpywareTerminator -> %ProgramFiles%\Spyware Terminator\Spywareterminatorshield.Exe ["C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"] -> Crawler.com [Ver = 2.0.1.194 | Size = 2834432 bytes | Modified Date = 12/12/2007 11:05:48 AM | Attr = ]
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_05\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 144784 bytes | Modified Date = 2/22/2008 4:25:21 AM | Attr = ]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
swg -> %ProgramFiles%\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe] -> Google Inc. [Ver = 1, 2, 1128, 5462 | Size = 171448 bytes | Modified Date = 4/22/2008 10:03:35 PM | Attr = ]
Yahoo! Pager -> %ProgramFiles%\Yahoo!\Messenger\YahooMessenger.exe ["C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet] -> Yahoo! Inc. [Ver = 8,1,0,239 | Size = 4670968 bytes | Modified Date = 1/19/2007 1:49:28 PM | Attr = ]
< Run [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\] > -> HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
swg -> %ProgramFiles%\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe] -> Google Inc. [Ver = 1, 2, 1128, 5462 | Size = 171448 bytes | Modified Date = 4/22/2008 10:03:35 PM | Attr = ]
Yahoo! Pager -> %ProgramFiles%\Yahoo!\Messenger\YahooMessenger.exe ["C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet] -> Yahoo! Inc. [Ver = 8,1,0,239 | Size = 4670968 bytes | Modified Date = 1/19/2007 1:49:28 PM | Attr = ]
< Acount Of Death Startup Folder > -> C:\Documents and Settings\Acount Of Death\Start Menu\Programs\Startup ->
%UserProfile%\Start Menu\Programs\Startup\LimeWire On Startup.lnk -> %ProgramFiles%\LimeWire\LimeWire.exe -> Lime Wire, LLC [Ver = 1, 0, 0, 2 | Size = 147456 bytes | Modified Date = 9/17/2007 7:19:14 AM | Attr = ]
< Administrator Startup Folder > -> C:\Documents and Settings\Administrator\Start Menu\Programs\Startup ->
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup ->
< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup ->
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders ->
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006] > -> HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->
WgaLogon -> -> File not found
< CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun -> 67108863 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 255 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\DisableRegistryTools -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\HideLegacyLogonScripts -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\HideLogoffScripts -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\RunLogonScriptSync -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\RunStartupScriptSync -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\HideStartupScripts -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ -> ->
< CurrentVersion Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\HideLegacyLogonScripts -> 0 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\HideLogoffScripts -> 0 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\RunLogonScriptSync -> 1 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\RunStartupScriptSync -> 1 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\HideStartupScripts -> 0 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ -> ->
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\ -> ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\ -> ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006] > -> HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ -> ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\HideLegacyLogonScripts -> 0 ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\HideLogoffScripts -> 0 ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\RunLogonScriptSync -> 1 ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\RunStartupScriptSync -> 1 ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\HideStartupScripts -> 0 ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ -> ->
< HOSTS File > (27 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts ->
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> ->
HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL -> http://go.microsoft....k/?LinkId=69157 ->
HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL -> http://go.microsoft....k/?LinkId=54896 ->
HKEY_LOCAL_MACHINE\: Main\\Local Page -> C:\windows\system32\blank.htm ->
HKEY_LOCAL_MACHINE\: Main\\Search Page -> http://go.microsoft....k/?LinkId=54896 ->
HKEY_LOCAL_MACHINE\: Main\\Start Page -> http://www.microsoft...p...ER}&ar=home ->
HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch -> http://ie.search.msn...st/srchcust.htm ->
HKEY_LOCAL_MACHINE\: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKEY_LOCAL_MACHINE\: Search\\SearchAssistant -> http://ie.search.msn...st/srchasst.htm ->
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> ->
HKEY_CURRENT_USER\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm ->
HKEY_CURRENT_USER\: Main\\Search Bar -> http://www.google.com/ie ->
HKEY_CURRENT_USER\: Main\\Search Page -> http://www.google.com ->
HKEY_CURRENT_USER\: Main\\Start Page -> http://www.geekstogo...xs-t195708.html ->
HKEY_CURRENT_USER\: Search\\SearchAssistant -> http://www.google.com/ie ->
HKEY_CURRENT_USER\: SearchURL\\ -> http://www.google.com/search?q=%s[gogl] ->
HKEY_CURRENT_USER\: ProxyEnable -> 0 ->
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> ->
HKEY_USERS\.DEFAULT\: Main\\Search Page -> http://www.microsoft...amp;ar=iesearch ->
HKEY_USERS\.DEFAULT\: Main\\Start Page -> http://www.microsoft...p...&ar=msnhome ->
HKEY_USERS\.DEFAULT\: ProxyEnable -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> ->
HKEY_USERS\S-1-5-18\: Main\\Search Page -> http://www.microsoft...amp;ar=iesearch ->
HKEY_USERS\S-1-5-18\: Main\\Start Page -> http://www.microsoft...p...&ar=msnhome ->
HKEY_USERS\S-1-5-18\: ProxyEnable -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\] > -> ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\: Main\\Search Bar -> http://www.google.com/ie ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\: Main\\Search Page -> http://www.google.com ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\: Main\\Start Page -> http://www.geekstogo...xs-t195708.html ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\: Search\\SearchAssistant -> http://www.google.com/ie ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\: SearchURL\\ -> http://www.google.com/search?q=%s[gogl] ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\: ProxyEnable -> 0 ->
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. ->
1 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\] > -> HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\] > -> HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ->
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 509328 bytes | Modified Date = 2/22/2008 4:25:19 AM | Attr = ]
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [Google Toolbar Helper] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 4/22/2008 10:03:09 PM | Attr = R ]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar ->
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [&Google] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 4/22/2008 10:03:09 PM | Attr = R ]
SITEguard [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.] -> File not found
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [&Google] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 4/22/2008 10:03:09 PM | Attr = R ]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\] > -> HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Google\GoogleToolbar2.dll [&Google] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 4/22/2008 10:03:09 PM | Attr = R ]
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\npjpi160_05.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 132496 bytes | Modified Date = 2/22/2008 4:25:19 AM | Attr = ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} [HKEY_CURRENT_USER] -> %ProgramFiles%\Java\jre1.6.0_05\bin\ssv.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 509328 bytes | Modified Date = 2/22/2008 4:25:19 AM | Attr = ]
{461CC20B-FB6E-4f16-8FE8-C29359DB100E}:BandCLSID -> %ProgramFiles%\BitComet\tools\BitCometBHO_1.1.9.24.dll [BitComet Search] -> BitComet [Ver = 20070924 | Size = 521528 bytes | Modified Date = 9/28/2007 6:30:46 AM | Attr = ]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\npjpi160_05.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 132496 bytes | Modified Date = 2/22/2008 4:25:19 AM | Attr = ]
CmdMapping\\{461CC20B-FB6E-4f16-8FE8-C29359DB100E} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\BitComet\tools\BitCometBHO_1.1.9.24.dll [BitComet Search] -> BitComet [Ver = 20070924 | Size = 521528 bytes | Modified Date = 9/28/2007 6:30:46 AM | Attr = ]
< Internet Explorer Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\npjpi160_05.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 132496 bytes | Modified Date = 2/22/2008 4:25:19 AM | Attr = ]
CmdMapping\\{461CC20B-FB6E-4f16-8FE8-C29359DB100E} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\BitComet\tools\BitCometBHO_1.1.9.24.dll [BitComet Search] -> BitComet [Ver = 20070924 | Size = 521528 bytes | Modified Date = 9/28/2007 6:30:46 AM | Attr = ]
< Internet Explorer Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\npjpi160_05.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 132496 bytes | Modified Date = 2/22/2008 4:25:19 AM | Attr = ]
CmdMapping\\{461CC20B-FB6E-4f16-8FE8-C29359DB100E} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\BitComet\tools\BitCometBHO_1.1.9.24.dll [BitComet Search] -> BitComet [Ver = 20070924 | Size = 521528 bytes | Modified Date = 9/28/2007 6:30:46 AM | Attr = ]
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\] > -> HKEY_USERS\S-1-5-21-1220945662-1229272821-1801674531-1006\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_05\bin\npjpi160_05.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 132496 bytes | Modified Date = 2/22/2008 4:25:19 AM | Attr = ]
CmdMapping\\{461CC20B-FB6E-4f16-8FE8-C29359DB100E} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\BitComet\tools\BitCometBHO_1.1.9.24.dll [BitComet Search] -> BitComet [Ver = 20070924 | Size = 521528 bytes | Modified Date = 9/28/2007 6:30:46 AM | Attr = ]
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ ->
PluginsPageFriendlyName -> Microsoft ActiveX Gallery ->
PluginsPage -> http://activex.micro...d...=%s&mime=%s ->
< DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ ->
{2B2D1F69-7D22-4383-9F0A-B7787AE1E8C5} -> (1394 Net Adapter) ->
{37E7F540-2311-4587-8E30-0268FE181957} -> () ->
{77FFE8DC-BE56-4948-BABA-FECD6D6847E1} -> (Realtek RTL8139 Family PCI Fast Ethernet NIC) ->
{DD299B1F-FC91-4EA5-9B7D-145300C4B2A5} -> (Broadcom 440x 10/100 Integrated Controller) ->
< Winsock2 Catalogs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\ ->
NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] -> %ProgramFiles%\Bonjour\mdnsNSP.dll -> Apple Computer, Inc. [Ver = 1,0,3,1 | Size = 94208 bytes | Modified Date = 2/28/2006 12:42:30 PM | Attr = ]
< Protocol Handlers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ ->
ipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
msdaipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ ->
{0000000A-0000-0010-8000-00AA00389B71}[HKEY_LOCAL_MACHINE] -> http://download.micr...0367/wmavax.CAB[Reg Error: Key does not exist or could not be opened.] ->
{20A60F0D-9AFA-4515-A0FD-83BD84642501}[HKEY_LOCAL_MACHINE] -> http://messenger.zon...kr.cab56986.cab[Checkers Class] ->
{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}[HKEY_LOCAL_MACHINE] -> C:\Program Files\Yahoo!\Common\yinsthelper.dll[YInstStarter Class] ->
{33564D57-0000-0010-8000-00AA00389B71}[HKEY_LOCAL_MACHINE] -> http://download.micr...922/wmv9VCM.CAB[Reg Error: Key does not exist or could not be opened.] ->
{6414512B-B978-451D-A0D8-FCFDF33E833C}[HKEY_LOCAL_MACHINE] -> http://update.micros...b?1075156122312[WUWebControl Class] ->
{8AD9C840-044E-11D1-B3E9-00805F499D93}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/...indows-i586.cab[Java Plug-in 1.6.0_05] ->
{B8BE5E93-A60C-4D26-A2DC-220313175592}[HKEY_LOCAL_MACHINE] -> http://messenger.zon...ro.cab56649.cab[MSN Games - Installer] ->
{C3F79A2B-B9B4-4A66-B012-3EE46475B072}[HKEY_LOCAL_MACHINE] -> http://messenger.zon...nt.cab56907.cab[MessengerStatsClient Class] ->
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/...indows-i586.cab[Java Plug-in 1.6.0_05] ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/...indows-i586.cab[Java Plug-in 1.6.0_05] ->
{E6187999-9FEC-46A1-A20F-F4CA977D5643}[HKEY_LOCAL_MACHINE] -> http://messenger.zon...ss.cab57176.cab[ZoneChess Object] ->
{F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8}[HKEY_LOCAL_MACHINE] -> https://secure.gopet...v/GoPetsWeb.cab[GoPetsWeb Control] ->
< Module Usage Keys [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/Chess.ocx\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/Chess.ocx\\.Owner -> {E6187999-9FEC-46A1-A20F-F4CA977D5643} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/Chess.ocx\\{E6187999-9FEC-46A1-A20F-F4CA977D5643} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/GoPetsWeb.ocx\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/GoPetsWeb.ocx\\.Owner -> {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/GoPetsWeb.ocx\\{F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MessengerStatsPAClient.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MessengerStatsPAClient.dll\\.Owner -> {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MessengerStatsPAClient.dll\\{C3F79A2B-B9B4-4A66-B012-3EE46475B072} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/msgrchkr.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/msgrchkr.dll\\.Owner -> {20A60F0D-9AFA-4515-A0FD-83BD84642501} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/msgrchkr.dll\\{20A60F0D-9AFA-4515-A0FD-83BD84642501} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ZIntro.ocx\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ZIntro.ocx\\.Owner -> {B8BE5E93-A60C-4D26-A2DC-220313175592} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ZIntro.ocx\\{B8BE5E93-A60C-4D26-A2DC-220313175592} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/wuweb.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/wuweb.dll\\.Owner -> Unknown Owner ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/wuweb.dll\\{6414512B-B978-451D-A0D8-FCFDF33E833C} -> ->

#13
helpme?

Posted 24 April 2008 - 08:34 PM

Member

Topic Starter
Member
46 posts

[Registry - Additional Scans - Non-Microsoft Only]
< Desktop Components > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\ ->
0 -> [Key] ->
0 -> FriendlyName = My Current Home Page ->
0 -> Source = About:Home ->
0 -> SubscribedURL = About:Home ->
< MountsPoints2 > -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c9e8141-4362-11d8-8cbc-806d6172696f}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c9e8141-4362-11d8-8cbc-806d6172696f}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c9e8141-4362-11d8-8cbc-806d6172696f}\\_AutorunStatus -> 01 00 01 00 00 01 00 DF DF 5F CF 5F 5F 5F 5F 01 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 60 00 00 00 0A 00 00 00 [binary data] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3409c3ee-4360-11d8-94ee-806d6172696f}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3409c3ee-4360-11d8-94ee-806d6172696f}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8458b444-2495-11d8-be2c-806d6172696f}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8458b444-2495-11d8-be2c-806d6172696f}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7b83adb-2491-11d8-b573-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7b83adb-2491-11d8-b573-00123fd353e5}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\\_AutorunStatus -> 01 00 01 00 00 01 00 DF DF 5F 01 00 01 01 EE FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 20 00 00 00 09 00 00 00 [binary data] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\Name\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\Name\\ -> The Sims 2 FreeTime ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\_Autorun\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\_Autorun\DefaultIcon\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c88342ea-7099-11dc-b567-00123fd353e5}\_Autorun\DefaultIcon\\ -> F:\AUTORUN.ICO [F:\AUTORUN.ICO] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d968995f-82b9-11dc-b59d-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d968995f-82b9-11dc-b59d-00123fd353e5}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\\_AutorunStatus -> 01 00 01 00 00 01 00 DF DF 5F 01 00 01 01 EE FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 20 00 00 00 09 00 00 00 [binary data] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\Name\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\Name\\ -> The Sims 2 Teen Style Stuff ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\_Autorun\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\_Autorun\DefaultIcon\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689960-82b9-11dc-b59d-00123fd353e5}\_Autorun\DefaultIcon\\ -> I:\Sims2SP6.ico [I:\Sims2SP6.ico] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689961-82b9-11dc-b59d-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9689961-82b9-11dc-b59d-00123fd353e5}\\BaseClass -> Drive ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0c9e8141-4362-11d8-8cbc-806d6172696f}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0c9e8141-4362-11d8-8cbc-806d6172696f}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0c9e8141-4362-11d8-8cbc-806d6172696f}\\Generation -> 2 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3409c3ee-4360-11d8-94ee-806d6172696f}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3409c3ee-4360-11d8-94ee-806d6172696f}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3409c3ee-4360-11d8-94ee-806d6172696f}\\Generation -> 2 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{8458b444-2495-11d8-be2c-806d6172696f}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{8458b444-2495-11d8-be2c-806d6172696f}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{8458b444-2495-11d8-be2c-806d6172696f}\\Generation -> 2 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{a7b83adb-2491-11d8-b573-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{a7b83adb-2491-11d8-b573-00123fd353e5}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{a7b83adb-2491-11d8-b573-00123fd353e5}\\Generation -> 2 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{c88342ea-7099-11dc-b567-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{c88342ea-7099-11dc-b567-00123fd353e5}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{c88342ea-7099-11dc-b567-00123fd353e5}\\Generation -> 2 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d968995f-82b9-11dc-b59d-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d968995f-82b9-11dc-b59d-00123fd353e5}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d968995f-82b9-11dc-b59d-00123fd353e5}\\Generation -> 2 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d9689960-82b9-11dc-b59d-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d9689960-82b9-11dc-b59d-00123fd353e5}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d9689960-82b9-11dc-b59d-00123fd353e5}\\Generation -> 2 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d9689961-82b9-11dc-b59d-00123fd353e5}\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d9689961-82b9-11dc-b59d-00123fd353e5}\\Data -> [Binary data over 100 bytes] ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d9689961-82b9-11dc-b59d-00123fd353e5}\\Generation -> 2 ->

#14
helpme?

Posted 24 April 2008 - 08:36 PM

Member

Topic Starter
Member
46 posts

[Files/Folders - Created Within 90 days]
$LDR$ -> %SystemDrive%\$LDR$ -> [Ver = | Size = 260272 bytes | Created Date = 3/30/2008 1:31:44 AM | Attr = R ]
$WIN_NT$.~BT -> %SystemDrive%\$WIN_NT$.~BT -> [Folder | Created Date = 3/30/2008 1:31:19 AM | Attr = ]
BOOT.BAK -> %SystemDrive%\BOOT.BAK -> [Ver = | Size = 211 bytes | Created Date = 3/30/2008 1:31:45 AM | Attr = HS]
QooBox -> %SystemDrive%\QooBox -> [Folder | Created Date = 4/24/2008 1:27:02 PM | Attr = ]
sqmdata03.sqm -> %SystemDrive%\sqmdata03.sqm -> [Ver = | Size = 268 bytes | Created Date = 4/22/2008 11:52:36 PM | Attr = H ]
sqmnoopt03.sqm -> %SystemDrive%\sqmnoopt03.sqm -> [Ver = | Size = 244 bytes | Created Date = 4/22/2008 11:52:36 PM | Attr = H ]
txtsetup.sif -> %SystemDrive%\txtsetup.sif -> [Ver = | Size = 472007 bytes | Created Date = 3/30/2008 1:31:44 AM | Attr = R ]
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [Folder | Created Date = 4/23/2008 2:52:09 AM | Attr = ]
aavmker4.sys -> %SystemRoot%\System32\drivers\aavmker4.sys -> ALWIL Software [Ver = 4.8.1169.0 | Size = 26944 bytes | Created Date = 4/22/2008 11:13:28 PM | Attr = ]
aswFsBlk.sys -> %SystemRoot%\System32\drivers\aswFsBlk.sys -> ALWIL Software [Ver = 4.8.1169.0 | Size = 20560 bytes | Created Date = 4/22/2008 11:12:56 PM | Attr = ]
aswmon.sys -> %SystemRoot%\System32\drivers\aswmon.sys -> ALWIL Software [Ver = 4.7.1098.0 | Size = 93264 bytes | Created Date = 4/22/2008 11:12:53 PM | Attr = ]
aswmon2.sys -> %SystemRoot%\System32\drivers\aswmon2.sys -> ALWIL Software [Ver = 4.8.1169.0 | Size = 94544 bytes | Created Date = 4/22/2008 11:12:53 PM | Attr = ]
aswRdr.sys -> %SystemRoot%\System32\drivers\aswRdr.sys -> ALWIL Software [Ver = 4.8.1169.0 | Size = 23152 bytes | Created Date = 4/22/2008 11:13:39 PM | Attr = ]
aswSP.sys -> %SystemRoot%\System32\drivers\aswSP.sys -> ALWIL Software [Ver = 4.8.1169.0 | Size = 75856 bytes | Created Date = 4/22/2008 11:12:56 PM | Attr = ]
aswTdi.sys -> %SystemRoot%\System32\drivers\aswTdi.sys -> ALWIL Software [Ver = 4.8.1169.0 | Size = 42912 bytes | Created Date = 4/22/2008 11:13:35 PM | Attr = ]
AVFilter.sys -> %SystemRoot%\System32\drivers\AVFilter.sys -> PC Tools Research Pty Ltd [Ver = 1, 3, 0, 0 | Size = 21904 bytes | Created Date = 4/6/2008 3:13:15 PM | Attr = ]
AVHook.sys -> %SystemRoot%\System32\drivers\AVHook.sys -> PC Tools Research Pty Ltd. [Ver = 3.00.012 Build 012 | Size = 28568 bytes | Created Date = 4/6/2008 3:13:15 PM | Attr = ]
AVRec.sys -> %SystemRoot%\System32\drivers\AVRec.sys -> PC Tools Research Pty Ltd [Ver = 3.00.012 Build 012 | Size = 21912 bytes | Created Date = 4/6/2008 3:13:15 PM | Attr = ]
actskin4.ocx -> %SystemRoot%\System32\actskin4.ocx -> [Ver = 4, 2, 7, 3 | Size = 380928 bytes | Created Date = 4/22/2008 11:12:19 PM | Attr = ]
aswBoot.exe -> %SystemRoot%\System32\aswBoot.exe -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 1146232 bytes | Created Date = 4/22/2008 11:12:19 PM | Attr = ]
AvastSS.scr -> %SystemRoot%\System32\AvastSS.scr -> ALWIL Software [Ver = 4, 8, 1169, 0 | Size = 95608 bytes | Created Date = 4/22/2008 11:13:16 PM | Attr = ]
bmottasd.ini -> %SystemRoot%\System32\bmottasd.ini -> [Ver = | Size = 1602653 bytes | Created Date = 4/15/2008 9:16:37 PM | Attr = HS]
CmdLineExt.dll -> %SystemRoot%\System32\CmdLineExt.dll -> Sony DADC Austria AG. [Ver = 1,1,222,0 | Size = 107888 bytes | Created Date = 3/14/2008 10:36:59 PM | Attr = ]
dumphive.exe -> %SystemRoot%\System32\dumphive.exe -> [Ver = | Size = 51200 bytes | Created Date = 4/9/2008 8:12:52 PM | Attr = ]
elmpwpql.exe -> %SystemRoot%\System32\elmpwpql.exe -> [Ver = | Size = 106496 bytes | Created Date = 4/6/2008 2:18:43 AM | Attr = ]
IEDFix.exe -> %SystemRoot%\System32\IEDFix.exe -> S!Ri.URZ [Ver = | Size = 82432 bytes | Created Date = 4/9/2008 8:12:53 PM | Attr = ]
java.exe -> %SystemRoot%\System32\java.exe -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 135168 bytes | Created Date = 4/22/2008 9:56:26 PM | Attr = ]
javacpl.cpl -> %SystemRoot%\System32\javacpl.cpl -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 69632 bytes | Created Date = 4/22/2008 9:56:35 PM | Attr = ]
javaw.exe -> %SystemRoot%\System32\javaw.exe -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 135168 bytes | Created Date = 4/22/2008 9:56:29 PM | Attr = ]
javaws.exe -> %SystemRoot%\System32\javaws.exe -> Sun Microsystems, Inc. [Ver = 6.0.50.13 | Size = 139264 bytes | Created Date = 4/22/2008 9:56:34 PM | Attr = ]
lifaxcim.ini -> %SystemRoot%\System32\lifaxcim.ini -> [Ver = | Size = 354 bytes | Created Date = 2/29/2008 2:41:10 AM | Attr = HS]
nlqumjcw.ini -> %SystemRoot%\System32\nlqumjcw.ini -> [Ver = | Size = 2389522 bytes | Created Date = 3/12/2008 2:20:45 AM | Attr = HS]
Process.exe -> %SystemRoot%\System32\Process.exe -> http://www.beyondlogic.org [Ver = 2, 0, 0, 0 | Size = 53248 bytes | Created Date = 4/9/2008 8:12:52 PM | Attr = ]
rjlsphbn.ini -> %SystemRoot%\System32\rjlsphbn.ini -> [Ver = | Size = 294 bytes | Created Date = 2/11/2008 12:30:25 PM | Attr = HS]
SrchSTS.exe -> %SystemRoot%\System32\SrchSTS.exe -> S!Ri [Ver = | Size = 288417 bytes | Created Date = 4/9/2008 8:12:52 PM | Attr = ]
VACFix.exe -> %SystemRoot%\System32\VACFix.exe -> S!Ri.URZ [Ver = | Size = 86528 bytes | Created Date = 4/9/2008 8:12:53 PM | Attr = ]
VCCLSID.exe -> %SystemRoot%\System32\VCCLSID.exe -> S!Ri [Ver = | Size = 289144 bytes | Created Date = 4/9/2008 8:12:53 PM | Attr = ]
wpoxtjel.ini -> %SystemRoot%\System32\wpoxtjel.ini -> [Ver = | Size = 294 bytes | Created Date = 2/16/2008 11:54:34 AM | Attr = HS]
WS2Fix.exe -> %SystemRoot%\System32\WS2Fix.exe -> [Ver = | Size = 25600 bytes | Created Date = 4/9/2008 8:12:53 PM | Attr = ]
$NtServicePackUninstallIDNMitigationAPIs$ -> %SystemRoot%\$NtServicePackUninstallIDNMitigationAPIs$ -> [Folder | Created Date = 3/24/2008 10:29:47 PM | Attr = H ]
5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
$NtServicePackUninstallNLSDownlevelMapping$ -> %SystemRoot%\$NtServicePackUninstallNLSDownlevelMapping$ -> [Folder | Created Date = 3/24/2008 10:20:06 PM | Attr = H ]
atibejkv.dll -> %SystemRoot%\atibejkv.dll -> [Ver = | Size = 67584 bytes | Created Date = 4/6/2008 2:18:10 AM | Attr = ]
BM078481a4.xml -> %SystemRoot%\BM078481a4.xml -> [Ver = | Size = 109111 bytes | Created Date = 1/30/2008 10:34:42 PM | Attr = ]
erdnt -> %SystemRoot%\erdnt -> [Folder | Created Date = 4/24/2008 1:27:26 PM | Attr = ]
fdsv.exe -> %SystemRoot%\fdsv.exe -> Smallfrogs Studio [Ver = 1.0.0.10 | Size = 73728 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
grep.exe -> %SystemRoot%\grep.exe -> [Ver = | Size = 80412 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
hixctiny.dll -> %SystemRoot%\hixctiny.dll -> [Ver = | Size = 182784 bytes | Created Date = 4/6/2008 2:18:24 AM | Attr = ]
imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1355 bytes | Created Date = 4/9/2008 3:03:13 AM | Attr = ]
Minidump -> %SystemRoot%\Minidump -> [Folder | Created Date = 4/20/2008 1:04:56 PM | Attr = ]
network diagnostic -> %SystemRoot%\network diagnostic -> [Folder | Created Date = 3/24/2008 9:56:41 PM | Attr = ]
Nircmd.exe -> %SystemRoot%\Nircmd.exe -> NirSoft [Ver = 2.05 | Size = 28160 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
PIF -> %SystemRoot%\PIF -> [Folder | Created Date = 4/17/2008 10:11:49 PM | Attr = H ]
sed.exe -> %SystemRoot%\sed.exe -> [Ver = | Size = 98816 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
setup.pss -> %SystemRoot%\setup.pss -> [Folder | Created Date = 3/30/2008 1:31:18 AM | Attr = ]
setupupd -> %SystemRoot%\setupupd -> [Folder | Created Date = 3/30/2008 1:30:57 AM | Attr = ]
swreg.exe -> %SystemRoot%\swreg.exe -> SteelWerX [Ver = 3.0.0.0 | Size = 161792 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
swsc.exe -> %SystemRoot%\swsc.exe -> SteelWerX [Ver = 2.0.0.5 | Size = 136704 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
swxcacls.exe -> %SystemRoot%\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 212480 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
uprjiefj -> %SystemRoot%\uprjiefj -> [Folder | Created Date = 4/6/2008 2:18:25 AM | Attr = ]
VFind.exe -> %SystemRoot%\VFind.exe -> [Ver = | Size = 49152 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
zip.exe -> %SystemRoot%\zip.exe -> [Ver = | Size = 68096 bytes | Created Date = 4/24/2008 1:27:00 PM | Attr = ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job -> [Ver = | Size = 284 bytes | Created Date = 4/14/2008 2:14:00 PM | Attr = ]
[Files Created - Additional Folder Scans - Non-Microsoft Only]
Earthsim -> %AllUsersProfile%\Application Data\Earthsim -> [Folder | Created Date = 2/28/2008 2:26:19 AM | Attr = ]
Lavasoft -> %AllUsersProfile%\Application Data\Lavasoft -> [Folder | Created Date = 4/8/2008 2:11:43 AM | Attr = ]
MPK -> %AllUsersProfile%\Application Data\MPK -> [Folder | Created Date = 3/14/2008 2:15:11 AM | Attr = HS]
mvkpyfkp.dll -> %AllUsersProfile%\Application Data\mvkpyfkp.dll -> [Ver = | Size = 67584 bytes | Created Date = 4/6/2008 2:19:30 AM | Attr = ]
PC Tools -> %AllUsersProfile%\Application Data\PC Tools -> [Folder | Created Date = 4/6/2008 3:13:06 PM | Attr = ]
SITEguard -> %AllUsersProfile%\Application Data\SITEguard -> [Folder | Created Date = 4/6/2008 3:32:05 PM | Attr = ]
STOPzilla! -> %AllUsersProfile%\Application Data\STOPzilla! -> [Folder | Created Date = 4/6/2008 2:30:55 PM | Attr = ]
Adobe -> %AppData%\Adobe -> [Folder | Created Date = 4/14/2008 8:51:18 PM | Attr = ]
desktop.ini -> %AppData%\desktop.ini -> [Ver = | Size = 62 bytes | Created Date = 4/14/2008 4:43:35 PM | Attr = HS]
Google -> %AppData%\Google -> [Folder | Created Date = 4/22/2008 10:02:14 PM | Attr = ]
Help -> %AppData%\Help -> [Folder | Created Date = 4/19/2008 11:33:49 PM | Attr = ]
Identities -> %AppData%\Identities -> [Folder | Created Date = 4/14/2008 4:44:08 PM | Attr = ]
LimeWire -> %AppData%\LimeWire -> [Folder | Created Date = 4/15/2008 6:58:47 AM | Attr = ]
Macromedia -> %AppData%\Macromedia -> [Folder | Created Date = 4/14/2008 8:40:01 PM | Attr = ]
Microsoft -> %AppData%\Microsoft -> [Folder | Created Date = 4/14/2008 4:43:35 PM | Attr = S]
Opera -> %AppData%\Opera -> [Folder | Created Date = 4/14/2008 8:48:10 PM | Attr = ]
Spyware Terminator -> %AppData%\Spyware Terminator -> [Folder | Created Date = 4/14/2008 4:44:44 PM | Attr = ]
Sun -> %AppData%\Sun -> [Folder | Created Date = 4/22/2008 9:18:23 PM | Attr = ]
WinRAR -> %AppData%\WinRAR -> [Folder | Created Date = 4/15/2008 6:55:51 AM | Attr = ]
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> %UserProfile%\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [Ver = | Size = 11264 bytes | Created Date = 4/17/2008 12:58:48 AM | Attr = ]
Google -> %UserProfile%\Local Settings\Application Data\Google -> [Folder | Created Date = 4/22/2008 10:02:14 PM | Attr = ]
Help -> %UserProfile%\Local Settings\Application Data\Help -> [Folder | Created Date = 4/19/2008 11:33:49 PM | Attr = ]
IconCache.db -> %UserProfile%\Local Settings\Application Data\IconCache.db -> [Ver = | Size = 3232386 bytes | Created Date = 4/15/2008 2:08:14 PM | Attr = H ]
Microsoft -> %UserProfile%\Local Settings\Application Data\Microsoft -> [Folder | Created Date = 4/14/2008 4:43:34 PM | Attr = ]
WMTools Downloaded Files -> %UserProfile%\Local Settings\Application Data\WMTools Downloaded Files -> [Folder | Created Date = 4/21/2008 12:09:46 AM | Attr = ]
EA Games -> %AllUsersProfile%\Documents\EA Games -> [Folder | Created Date = 4/3/2008 3:00:33 AM | Attr = ]
1208924281284-integrated.jnlp -> %UserProfile%\My Documents\1208924281284-integrated.jnlp -> [Ver = | Size = 1283 bytes | Created Date = 4/22/2008 9:18:14 PM | Attr = ]
@Alternate Data Stream - 26 bytes -> %UserProfile%\My Documents\1208924281284-integrated.jnlp:Zone.Identifier
Application V2.1.3A -> %UserProfile%\My Documents\Application V2.1.3A -> [Folder | Created Date = 4/23/2008 11:15:04 AM | Attr = ]
ARA01_01 -> %UserProfile%\My Documents\ARA01_01 -> [Folder | Created Date = 4/23/2008 11:17:25 AM | Attr = ]
ARA01_02 -> %UserProfile%\My Documents\ARA01_02 -> [Folder | Created Date = 4/23/2008 11:17:27 AM | Attr = ]
ARA01_03 -> %UserProfile%\My Documents\ARA01_03 -> [Folder | Created Date = 4/23/2008 11:17:29 AM | Attr = ]
ARA01_04 -> %UserProfile%\My Documents\ARA01_04 -> [Folder | Created Date = 4/23/2008 11:17:30 AM | Attr = ]
ARA01_05 -> %UserProfile%\My Documents\ARA01_05 -> [Folder | Created Date = 4/23/2008 11:17:32 AM | Attr = ]
ARA01_06 -> %UserProfile%\My Documents\ARA01_06 -> [Folder | Created Date = 4/23/2008 11:17:33 AM | Attr = ]
ARA01_07 -> %UserProfile%\My Documents\ARA01_07 -> [Folder | Created Date = 4/23/2008 11:17:35 AM | Attr = ]
ARA01_08 -> %UserProfile%\My Documents\ARA01_08 -> [Folder | Created Date = 4/23/2008 11:17:36 AM | Attr = ]
ARA01_09 -> %UserProfile%\My Documents\ARA01_09 -> [Folder | Created Date = 4/23/2008 11:17:38 AM | Attr = ]
ARA01_10 -> %UserProfile%\My Documents\ARA01_10 -> [Folder | Created Date = 4/23/2008 11:17:42 AM | Attr = ]
ARA01_11 -> %UserProfile%\My Documents\ARA01_11 -> [Folder | Created Date = 4/23/2008 11:17:44 AM | Attr = ]
ARA02_01 -> %UserProfile%\My Documents\ARA02_01 -> [Folder | Created Date = 4/23/2008 11:17:45 AM | Attr = ]
ARA02_02 -> %UserProfile%\My Documents\ARA02_02 -> [Folder | Created Date = 4/23/2008 11:17:47 AM | Attr = ]
ARA02_03 -> %UserProfile%\My Documents\ARA02_03 -> [Folder | Created Date = 4/23/2008 11:17:48 AM | Attr = ]
ARA02_04 -> %UserProfile%\My Documents\ARA02_04 -> [Folder | Created Date = 4/23/2008 11:17:50 AM | Attr = ]
ARA02_05 -> %UserProfile%\My Documents\ARA02_05 -> [Folder | Created Date = 4/23/2008 11:17:54 AM | Attr = ]
ARA02_06 -> %UserProfile%\My Documents\ARA02_06 -> [Folder | Created Date = 4/23/2008 11:17:56 AM | Attr = ]
ARA02_07 -> %UserProfile%\My Documents\ARA02_07 -> [Folder | Created Date = 4/23/2008 11:17:58 AM | Attr = ]
ARA02_08 -> %UserProfile%\My Documents\ARA02_08 -> [Folder | Created Date = 4/23/2008 11:17:59 AM | Attr = ]
ARA02_09 -> %UserProfile%\My Documents\ARA02_09 -> [Folder | Created Date = 4/23/2008 11:18:01 AM | Attr = ]
ARA02_10 -> %UserProfile%\My Documents\ARA02_10 -> [Folder | Created Date = 4/23/2008 11:18:03 AM | Attr = ]
ARA02_11 -> %UserProfile%\My Documents\ARA02_11 -> [Folder | Created Date = 4/23/2008 11:18:04 AM | Attr = ]
ARA03_01 -> %UserProfile%\My Documents\ARA03_01 -> [Folder | Created Date = 4/23/2008 11:18:06 AM | Attr = ]
ARA03_02 -> %UserProfile%\My Documents\ARA03_02 -> [Folder | Created Date = 4/23/2008 11:18:08 AM | Attr = ]
ARA03_03 -> %UserProfile%\My Documents\ARA03_03 -> [Folder | Created Date = 4/23/2008 11:18:10 AM | Attr = ]
ARA03_04 -> %UserProfile%\My Documents\ARA03_04 -> [Folder | Created Date = 4/23/2008 11:18:11 AM | Attr = ]
ARA03_05 -> %UserProfile%\My Documents\ARA03_05 -> [Folder | Created Date = 4/23/2008 11:18:13 AM | Attr = ]
ARA03_06 -> %UserProfile%\My Documents\ARA03_06 -> [Folder | Created Date = 4/23/2008 11:18:15 AM | Attr = ]
ARA03_07 -> %UserProfile%\My Documents\ARA03_07 -> [Folder | Created Date = 4/23/2008 11:18:19 AM | Attr = ]
ARA03_08 -> %UserProfile%\My Documents\ARA03_08 -> [Folder | Created Date = 4/23/2008 11:18:21 AM | Attr = ]
ARA03_09 -> %UserProfile%\My Documents\ARA03_09 -> [Folder | Created Date = 4/23/2008 11:18:22 AM | Attr = ]
ARA03_10 -> %UserProfile%\My Documents\ARA03_10 -> [Folder | Created Date = 4/23/2008 11:18:24 AM | Attr = ]
ARA03_11 -> %UserProfile%\My Documents\ARA03_11 -> [Folder | Created Date = 4/23/2008 11:18:25 AM | Attr = ]
ARA04_01 -> %UserProfile%\My Documents\ARA04_01 -> [Folder | Created Date = 4/23/2008 11:18:27 AM | Attr = ]
ARA04_02 -> %UserProfile%\My Documents\ARA04_02 -> [Folder | Created Date = 4/23/2008 11:18:28 AM | Attr = ]
ARA04_03 -> %UserProfile%\My Documents\ARA04_03 -> [Folder | Created Date = 4/23/2008 11:18:30 AM | Attr = ]
ARA04_04 -> %UserProfile%\My Documents\ARA04_04 -> [Folder | Created Date = 4/23/2008 11:18:32 AM | Attr = ]
ARA04_05 -> %UserProfile%\My Documents\ARA04_05 -> [Folder | Created Date = 4/23/2008 11:18:33 AM | Attr = ]
ARA04_06 -> %UserProfile%\My Documents\ARA04_06 -> [Folder | Created Date = 4/23/2008 11:18:34 AM | Attr = ]
ARA04_07 -> %UserProfile%\My Documents\ARA04_07 -> [Folder | Created Date = 4/23/2008 11:18:36 AM | Attr = ]
ARA04_08 -> %UserProfile%\My Documents\ARA04_08 -> [Folder | Created Date = 4/23/2008 11:18:38 AM | Attr = ]
ARA04_09 -> %UserProfile%\My Documents\ARA04_09 -> [Folder | Created Date = 4/23/2008 11:18:39 AM | Attr = ]
ARA04_10 -> %UserProfile%\My Documents\ARA04_10 -> [Folder | Created Date = 4/23/2008 11:18:41 AM | Attr = ]
ARA04_11 -> %UserProfile%\My Documents\ARA04_11 -> [Folder | Created Date = 4/23/2008 11:18:43 AM | Attr = ]
ARA05_01 -> %UserProfile%\My Documents\ARA05_01 -> [Folder | Created Date = 4/23/2008 11:18:44 AM | Attr = ]
ARA05_02 -> %UserProfile%\My Documents\ARA05_02 -> [Folder | Created Date = 4/23/2008 11:18:46 AM | Attr = ]
ARA05_03 -> %UserProfile%\My Documents\ARA05_03 -> [Folder | Created Date = 4/23/2008 11:18:48 AM | Attr = ]
ARA05_04 -> %UserProfile%\My Documents\ARA05_04 -> [Folder | Created Date = 4/23/2008 11:18:49 AM | Attr = ]
ARA05_05 -> %UserProfile%\My Documents\ARA05_05 -> [Folder | Created Date = 4/23/2008 11:18:51 AM | Attr = ]
ARA05_06 -> %UserProfile%\My Documents\ARA05_06 -> [Folder | Created Date = 4/23/2008 11:18:52 AM | Attr = ]
ARA05_07 -> %UserProfile%\My Documents\ARA05_07 -> [Folder | Created Date = 4/23/2008 11:18:57 AM | Attr = ]
ARA05_08 -> %UserProfile%\My Documents\ARA05_08 -> [Folder | Created Date = 4/23/2008 11:18:59 AM | Attr = ]
ARA05_09 -> %UserProfile%\My Documents\ARA05_09 -> [Folder | Created Date = 4/23/2008 11:19:00 AM | Attr = ]
ARA05_10 -> %UserProfile%\My Documents\ARA05_10 -> [Folder | Created Date = 4/23/2008 11:19:02 AM | Attr = ]
ARA05_11 -> %UserProfile%\My Documents\ARA05_11 -> [Folder | Created Date = 4/23/2008 11:19:04 AM | Attr = ]
ARA05_12 -> %UserProfile%\My Documents\ARA05_12 -> [Folder | Created Date = 4/23/2008 11:19:05 AM | Attr = ]
ARA06_01 -> %UserProfile%\My Documents\ARA06_01 -> [Folder | Created Date = 4/23/2008 11:19:07 AM | Attr = ]
ARA06_02 -> %UserProfile%\My Documents\ARA06_02 -> [Folder | Created Date = 4/23/2008 11:19:09 AM | Attr = ]
ARA06_03 -> %UserProfile%\My Documents\ARA06_03 -> [Folder | Created Date = 4/23/2008 11:19:10 AM | Attr = ]
ARA06_04 -> %UserProfile%\My Documents\ARA06_04 -> [Folder | Created Date = 4/23/2008 11:19:12 AM | Attr = ]
ARA06_05 -> %UserProfile%\My Documents\ARA06_05 -> [Folder | Created Date = 4/23/2008 11:19:14 AM | Attr = ]
ARA06_06 -> %UserProfile%\My Documents\ARA06_06 -> [Folder | Created Date = 4/23/2008 11:19:15 AM | Attr = ]
ARA06_07 -> %UserProfile%\My Documents\ARA06_07 -> [Folder | Created Date = 4/23/2008 11:19:17 AM | Attr = ]
ARA06_08 -> %UserProfile%\My Documents\ARA06_08 -> [Folder | Created Date = 4/23/2008 11:19:19 AM | Attr = ]
ARA06_09 -> %UserProfile%\My Documents\ARA06_09 -> [Folder | Created Date = 4/23/2008 11:19:20 AM | Attr = ]
ARA06_10 -> %UserProfile%\My Documents\ARA06_10 -> [Folder | Created Date = 4/23/2008 11:19:22 AM | Attr = ]
ARA06_11 -> %UserProfile%\My Documents\ARA06_11 -> [Folder | Created Date = 4/23/2008 11:19:24 AM | Attr = ]
ARA06_12 -> %UserProfile%\My Documents\ARA06_12 -> [Folder | Created Date = 4/23/2008 11:19:25 AM | Attr = ]
ARA07_01 -> %UserProfile%\My Documents\ARA07_01 -> [Folder | Created Date = 4/23/2008 11:19:27 AM | Attr = ]
ARA07_02 -> %UserProfile%\My Documents\ARA07_02 -> [Folder | Created Date = 4/23/2008 11:19:29 AM | Attr = ]
ARA07_03 -> %UserProfile%\My Documents\ARA07_03 -> [Folder | Created Date = 4/23/2008 11:19:31 AM | Attr = ]
ARA07_04 -> %UserProfile%\My Documents\ARA07_04 -> [Folder | Created Date = 4/23/2008 11:19:33 AM | Attr = ]
ARA07_05 -> %UserProfile%\My Documents\ARA07_05 -> [Folder | Created Date = 4/23/2008 11:19:35 AM | Attr = ]
ARA07_06 -> %UserProfile%\My Documents\ARA07_06 -> [Folder | Created Date = 4/23/2008 11:19:37 AM | Attr = ]
ARA07_07 -> %UserProfile%\My Documents\ARA07_07 -> [Folder | Created Date = 4/23/2008 11:19:38 AM | Attr = ]
ARA07_08 -> %UserProfile%\My Documents\ARA07_08 -> [Folder | Created Date = 4/23/2008 11:19:40 AM | Attr = ]
ARA07_09 -> %UserProfile%\My Documents\ARA07_09 -> [Folder | Created Date = 4/23/2008 11:19:42 AM | Attr = ]
ARA07_10 -> %UserProfile%\My Documents\ARA07_10 -> [Folder | Created Date = 4/23/2008 11:19:44 AM | Attr = ]
ARA07_11 -> %UserProfile%\My Documents\ARA07_11 -> [Folder | Created Date = 4/23/2008 11:19:45 AM | Attr = ]
ARA07_12 -> %UserProfile%\My Documents\ARA07_12 -> [Folder | Created Date = 4/23/2008 11:19:47 AM | Attr = ]
ARA08_01 -> %UserProfile%\My Documents\ARA08_01 -> [Folder | Created Date = 4/23/2008 11:19:51 AM | Attr = ]
ARA08_02 -> %UserProfile%\My Documents\ARA08_02 -> [Folder | Created Date = 4/23/2008 11:19:53 AM | Attr = ]
ARA08_03 -> %UserProfile%\My Documents\ARA08_03 -> [Folder | Created Date = 4/23/2008 11:19:54 AM | Attr = ]
ARA08_04 -> %UserProfile%\My Documents\ARA08_04 -> [Folder | Created Date = 4/23/2008 11:19:59 AM | Attr = ]
ARA08_05 -> %UserProfile%\My Documents\ARA08_05 -> [Folder | Created Date = 4/23/2008 11:20:01 AM | Attr = ]
ARA08_06 -> %UserProfile%\My Documents\ARA08_06 -> [Folder | Created Date = 4/23/2008 11:20:02 AM | Attr = ]
ARA08_07 -> %UserProfile%\My Documents\ARA08_07 -> [Folder | Created Date = 4/23/2008 11:20:04 AM | Attr = ]
ARA08_08 -> %UserProfile%\My Documents\ARA08_08 -> [Folder | Created Date = 4/23/2008 11:20:06 AM | Attr = ]
ARA08_09 -> %UserProfile%\My Documents\ARA08_09 -> [Folder | Created Date = 4/23/2008 11:20:08 AM | Attr = ]
ARA08_10 -> %UserProfile%\My Documents\ARA08_10 -> [Folder | Created Date = 4/23/2008 11:20:10 AM | Attr = ]
ARA08_11 -> %UserProfile%\My Documents\ARA08_11 -> [Folder | Created Date = 4/23/2008 11:20:14 AM | Attr = ]
ARA08_12 -> %UserProfile%\My Documents\ARA08_12 -> [Folder | Created Date = 4/23/2008 11:20:15 AM | Attr = ]
ARA09_01 -> %UserProfile%\My Documents\ARA09_01 -> [Folder | Created Date = 4/23/2008 11:20:17 AM | Attr = ]
ARA09_02 -> %UserProfile%\My Documents\ARA09_02 -> [Folder | Created Date = 4/23/2008 11:20:18 AM | Attr = ]
ARA09_03 -> %UserProfile%\My Documents\ARA09_03 -> [Folder | Created Date = 4/23/2008 11:20:20 AM | Attr = ]
ARA09_04 -> %UserProfile%\My Documents\ARA09_04 -> [Folder | Created Date = 4/23/2008 11:20:22 AM | Attr = ]
ARA09_05 -> %UserProfile%\My Documents\ARA09_05 -> [Folder | Created Date = 4/23/2008 11:20:23 AM | Attr = ]
ARA09_06 -> %UserProfile%\My Documents\ARA09_06 -> [Folder | Created Date = 4/23/2008 11:20:24 AM | Attr = ]
ARA09_07 -> %UserProfile%\My Documents\ARA09_07 -> [Folder | Created Date = 4/23/2008 11:20:26 AM | Attr = ]
ARA09_08 -> %UserProfile%\My Documents\ARA09_08 -> [Folder | Created Date = 4/23/2008 11:20:27 AM | Attr = ]
ARA09_09 -> %UserProfile%\My Documents\ARA09_09 -> [Folder | Created Date = 4/23/2008 11:20:29 AM | Attr = ]
ARA09_10 -> %UserProfile%\My Documents\ARA09_10 -> [Folder | Created Date = 4/23/2008 11:20:30 AM | Attr = ]
ARA09_11 -> %UserProfile%\My Documents\ARA09_11 -> [Folder | Created Date = 4/23/2008 11:20:32 AM | Attr = ]
ARA10_01 -> %UserProfile%\My Documents\ARA10_01 -> [Folder | Created Date = 4/23/2008 11:20:34 AM | Attr = ]
ARA10_02 -> %UserProfile%\My Documents\ARA10_02 -> [Folder | Created Date = 4/23/2008 11:20:35 AM | Attr = ]
ARA10_03 -> %UserProfile%\My Documents\ARA10_03 -> [Folder | Created Date = 4/23/2008 11:20:37 AM | Attr = ]
ARA10_04 -> %UserProfile%\My Documents\ARA10_04 -> [Folder | Created Date = 4/23/2008 11:20:40 AM | Attr = ]
ARA10_05 -> %UserProfile%\My Documents\ARA10_05 -> [Folder | Created Date = 4/23/2008 11:20:42 AM | Attr = ]
ARA10_06 -> %UserProfile%\My Documents\ARA10_06 -> [Folder | Created Date = 4/23/2008 11:20:43 AM | Attr = ]
ARA10_07 -> %UserProfile%\My Documents\ARA10_07 -> [Folder | Created Date = 4/23/2008 11:20:44 AM | Attr = ]
ARA10_08 -> %UserProfile%\My Documents\ARA10_08 -> [Folder | Created Date = 4/23/2008 11:20:46 AM | Attr = ]
ARA10_09 -> %UserProfile%\My Documents\ARA10_09 -> [Folder | Created Date = 4/23/2008 11:20:47 AM | Attr = ]
ARA10_10 -> %UserProfile%\My Documents\ARA10_10 -> [Folder | Created Date = 4/23/2008 11:20:49 AM | Attr = ]
ARA10_11 -> %UserProfile%\My Documents\ARA10_11 -> [Folder | Created Date = 4/23/2008 11:20:51 AM | Attr = ]
ARA11_01 -> %UserProfile%\My Documents\ARA11_01 -> [Folder | Created Date = 4/23/2008 11:20:53 AM | Attr = ]
ARA11_02 -> %UserProfile%\My Documents\ARA11_02 -> [Folder | Created Date = 4/23/2008 11:20:56 AM | Attr = ]
ARA11_03 -> %UserProfile%\My Documents\ARA11_03 -> [Folder | Created Date = 4/23/2008 11:21:01 AM | Attr = ]
ARA11_04 -> %UserProfile%\My Documents\ARA11_04 -> [Folder | Created Date = 4/23/2008 11:21:03 AM | Attr = ]
ARA11_05 -> %UserProfile%\My Documents\ARA11_05 -> [Folder | Created Date = 4/23/2008 11:21:05 AM | Attr = ]
ARA11_06 -> %UserProfile%\My Documents\ARA11_06 -> [Folder | Created Date = 4/23/2008 11:21:12 AM | Attr = ]
ARA11_07 -> %UserProfile%\My Documents\ARA11_07 -> [Folder | Created Date = 4/23/2008 11:21:16 AM | Attr = ]
ARA11_08 -> %UserProfile%\My Documents\ARA11_08 -> [Folder | Created Date = 4/23/2008 11:21:19 AM | Attr = ]
ARA11_09 -> %UserProfile%\My Documents\ARA11_09 -> [Folder | Created Date = 4/23/2008 11:21:23 AM | Attr = ]
ARA11_10 -> %UserProfile%\My Documents\ARA11_10 -> [Folder | Created Date = 4/23/2008 11:21:25 AM | Attr = ]
ARA11_11 -> %UserProfile%\My Documents\ARA11_11 -> [Folder | Created Date = 4/23/2008 11:21:28 AM | Attr = ]
ARA12_01 -> %UserProfile%\My Documents\ARA12_01 -> [Folder | Created Date = 4/23/2008 11:21:31 AM | Attr = ]
ARA12_02 -> %UserProfile%\My Documents\ARA12_02 -> [Folder | Created Date = 4/23/2008 11:21:32 AM | Attr = ]
ARA12_03 -> %UserProfile%\My Documents\ARA12_03 -> [Folder | Created Date = 4/23/2008 11:21:34 AM | Attr = ]
ARA12_04 -> %UserProfile%\My Documents\ARA12_04 -> [Folder | Created Date = 4/23/2008 11:21:37 AM | Attr = ]
ARA12_05 -> %UserProfile%\My Documents\ARA12_05 -> [Folder | Created Date = 4/23/2008 11:21:39 AM | Attr = ]
ARA12_06 -> %UserProfile%\My Documents\ARA12_06 -> [Folder | Created Date = 4/23/2008 11:21:42 AM | Attr = ]
ARA12_07 -> %UserProfile%\My Documents\ARA12_07 -> [Folder | Created Date = 4/23/2008 11:21:48 AM | Attr = ]
ARA12_08 -> %UserProfile%\My Documents\ARA12_08 -> [Folder | Created Date = 4/23/2008 11:21:51 AM | Attr = ]
ARA12_09 -> %UserProfile%\My Documents\ARA12_09 -> [Folder | Created Date = 4/23/2008 11:21:54 AM | Attr = ]
ARA12_10 -> %UserProfile%\My Documents\ARA12_10 -> [Folder | Created Date = 4/23/2008 11:21:58 AM | Attr = ]
ARA12_11 -> %UserProfile%\My Documents\ARA12_11 -> [Folder | Created Date = 4/23/2008 11:22:03 AM | Attr = ]
ARA13_01 -> %UserProfile%\My Documents\ARA13_01 -> [Folder | Created Date = 4/23/2008 11:22:08 AM | Attr = ]
ARA13_02 -> %UserProfile%\My Documents\ARA13_02 -> [Folder | Created Date = 4/23/2008 11:22:11 AM | Attr = ]
ARA13_03 -> %UserProfile%\My Documents\ARA13_03 -> [Folder | Created Date = 4/23/2008 11:22:15 AM | Attr = ]
ARA13_04 -> %UserProfile%\My Documents\ARA13_04 -> [Folder | Created Date = 4/23/2008 11:22:19 AM | Attr = ]
ARA13_05 -> %UserProfile%\My Documents\ARA13_05 -> [Folder | Created Date = 4/23/2008 11:22:23 AM | Attr = ]
ARA13_06 -> %UserProfile%\My Documents\ARA13_06 -> [Folder | Created Date = 4/23/2008 11:22:27 AM | Attr = ]
ARA13_07 -> %UserProfile%\My Documents\ARA13_07 -> [Folder | Created Date = 4/23/2008 11:22:30 AM | Attr = ]
ARA13_08 -> %UserProfile%\My Documents\ARA13_08 -> [Folder | Created Date = 4/23/2008 11:22:34 AM | Attr = ]
ARA13_09 -> %UserProfile%\My Documents\ARA13_09 -> [Folder | Created Date = 4/23/2008 11:22:36 AM | Attr = ]
ARA13_10 -> %UserProfile%\My Documents\ARA13_10 -> [Folder | Created Date = 4/23/2008 11:22:39 AM | Attr = ]
ARA13_11 -> %UserProfile%\My Documents\ARA13_11 -> [Folder | Created Date = 4/23/2008 11:22:41 AM | Attr = ]
ARA14_01 -> %UserProfile%\My Documents\ARA14_01 -> [Folder | Created Date = 4/23/2008 11:22:46 AM | Attr = ]
ARA14_02 -> %UserProfile%\My Documents\ARA14_02 -> [Folder | Created Date = 4/23/2008 11:22:50 AM | Attr = ]
ARA14_03 -> %UserProfile%\My Documents\ARA14_03 -> [Folder | Created Date = 4/23/2008 11:22:55 AM | Attr = ]
ARA14_04 -> %UserProfile%\My Documents\ARA14_04 -> [Folder | Created Date = 4/23/2008 11:22:57 AM | Attr = ]
ARA14_05 -> %UserProfile%\My Documents\ARA14_05 -> [Folder | Created Date = 4/23/2008 11:23:01 AM | Attr = ]
ARA14_06 -> %UserProfile%\My Documents\ARA14_06 -> [Folder | Created Date = 4/23/2008 11:23:07 AM | Attr = ]
ARA14_07 -> %UserProfile%\My Documents\ARA14_07 -> [Folder | Created Date = 4/23/2008 11:23:09 AM | Attr = ]
ARA14_08 -> %UserProfile%\My Documents\ARA14_08 -> [Folder | Created Date = 4/23/2008 11:23:11 AM | Attr = ]
ARA14_09 -> %UserProfile%\My Documents\ARA14_09 -> [Folder | Created Date = 4/23/2008 11:23:14 AM | Attr = ]
ARA14_10 -> %UserProfile%\My Documents\ARA14_10 -> [Folder | Created Date = 4/23/2008 11:23:15 AM | Attr = ]
ARA14_11 -> %UserProfile%\My Documents\ARA14_11 -> [Folder | Created Date = 4/23/2008 11:23:19 AM | Attr = ]
ARA15_01 -> %UserProfile%\My Documents\ARA15_01 -> [Folder | Created Date = 4/23/2008 11:23:21 AM | Attr = ]
ARA15_02 -> %UserProfile%\My Documents\ARA15_02 -> [Folder | Created Date = 4/23/2008 11:23:23 AM | Attr = ]
ARA15_03 -> %UserProfile%\My Documents\ARA15_03 -> [Folder | Created Date = 4/23/2008 11:23:25 AM | Attr = ]
ARA15_04 -> %UserProfile%\My Documents\ARA15_04 -> [Folder | Created Date = 4/23/2008 11:23:27 AM | Attr = ]
ARA15_05 -> %UserProfile%\My Documents\ARA15_05 -> [Folder | Created Date = 4/23/2008 11:23:30 AM | Attr = ]
ARA15_06 -> %UserProfile%\My Documents\ARA15_06 -> [Folder | Created Date = 4/23/2008 11:23:33 AM | Attr = ]
ARA15_07 -> %UserProfile%\My Documents\ARA15_07 -> [Folder | Created Date = 4/23/2008 11:23:35 AM | Attr = ]
ARA15_08 -> %UserProfile%\My Documents\ARA15_08 -> [Folder | Created Date = 4/23/2008 11:23:37 AM | Attr = ]
ARA15_09 -> %UserProfile%\My Documents\ARA15_09 -> [Folder | Created Date = 4/23/2008 11:23:41 AM | Attr = ]
ARA15_10 -> %UserProfile%\My Documents\ARA15_10 -> [Folder | Created Date = 4/23/2008 11:23:44 AM | Attr = ]
ARA15_11 -> %UserProfile%\My Documents\ARA15_11 -> [Folder | Created Date = 4/23/2008 11:23:47 AM | Attr = ]
ARA16_01 -> %UserProfile%\My Documents\ARA16_01 -> [Folder | Created Date = 4/23/2008 11:23:51 AM | Attr = ]
ARA16_02 -> %UserProfile%\My Documents\ARA16_02 -> [Folder | Created Date = 4/23/2008 11:23:53 AM | Attr = ]
ARA16_03 -> %UserProfile%\My Documents\ARA16_03 -> [Folder | Created Date = 4/23/2008 11:23:55 AM | Attr = ]
ARA16_04 -> %UserProfile%\My Documents\ARA16_04 -> [Folder | Created Date = 4/23/2008 11:23:57 AM | Attr = ]
ARA16_05 -> %UserProfile%\My Documents\ARA16_05 -> [Folder | Created Date = 4/23/2008 11:23:59 AM | Attr = ]
ARA16_06 -> %UserProfile%\My Documents\ARA16_06 -> [Folder | Created Date = 4/23/2008 11:24:02 AM | Attr = ]
ARA16_07 -> %UserProfile%\My Documents\ARA16_07 -> [Folder | Created Date = 4/23/2008 11:24:08 AM | Attr = ]
ARA16_08 -> %UserProfile%\My Documents\ARA16_08 -> [Folder | Created Date = 4/23/2008 11:24:11 AM | Attr = ]
ARA16_09 -> %UserProfile%\My Documents\ARA16_09 -> [Folder | Created Date = 4/23/2008 11:24:15 AM | Attr = ]
ARA16_10 -> %UserProfile%\My Documents\ARA16_10 -> [Folder | Created Date = 4/23/2008 11:24:19 AM | Attr = ]
ARA16_11 -> %UserProfile%\My Documents\ARA16_11 -> [Folder | Created Date = 4/23/2008 11:24:26 AM | Attr = ]
ARA17_01 -> %UserProfile%\My Documents\ARA17_01 -> [Folder | Created Date = 4/23/2008 11:24:28 AM | Attr = ]
ARA17_02 -> %UserProfile%\My Documents\ARA17_02 -> [Folder | Created Date = 4/23/2008 11:24:31 AM | Attr = ]
ARA17_03 -> %UserProfile%\My Documents\ARA17_03 -> [Folder | Created Date = 4/23/2008 11:24:33 AM | Attr = ]
ARA17_04 -> %UserProfile%\My Documents\ARA17_04 -> [Folder | Created Date = 4/23/2008 11:24:35 AM | Attr = ]
ARA17_05 -> %UserProfile%\My Documents\ARA17_05 -> [Folder | Created Date = 4/23/2008 11:24:38 AM | Attr = ]
ARA17_06 -> %UserProfile%\My Documents\ARA17_06 -> [Folder | Created Date = 4/23/2008 11:24:41 AM | Attr = ]
ARA17_07 -> %UserProfile%\My Documents\ARA17_07 -> [Folder | Created Date = 4/23/2008 11:24:44 AM | Attr = ]
ARA17_08 -> %UserProfile%\My Documents\ARA17_08 -> [Folder | Created Date = 4/23/2008 11:24:48 AM | Attr = ]
ARA17_09 -> %UserProfile%\My Documents\ARA17_09 -> [Folder | Created Date = 4/23/2008 11:24:50 AM | Attr = ]
ARA17_10 -> %UserProfile%\My Documents\ARA17_10 -> [Folder | Created Date = 4/23/2008 11:24:53 AM | Attr = ]
ARA18_01 -> %UserProfile%\My Documents\ARA18_01 -> [Folder | Created Date = 4/23/2008 11:24:58 AM | Attr = ]
ARA18_02 -> %UserProfile%\My Documents\ARA18_02 -> [Folder | Created Date = 4/23/2008 11:25:01 AM | Attr = ]
ARA18_03 -> %UserProfile%\My Documents\ARA18_03 -> [Folder | Created Date = 4/23/2008 11:25:04 AM | Attr = ]
ARA18_04 -> %UserProfile%\My Documents\ARA18_04 -> [Folder | Created Date = 4/23/2008 11:25:08 AM | Attr = ]
ARA18_05 -> %UserProfile%\My Documents\ARA18_05 -> [Folder | Created Date = 4/23/2008 11:25:12 AM | Attr = ]
ARA18_06 -> %UserProfile%\My Documents\ARA18_06 -> [Folder | Created Date = 4/23/2008 11:25:16 AM | Attr = ]
ARA18_07 -> %UserProfile%\My Documents\ARA18_07 -> [Folder | Created Date = 4/23/2008 11:25:20 AM | Attr = ]
ARA18_08 -> %UserProfile%\My Documents\ARA18_08 -> [Folder | Created Date = 4/23/2008 11:25:26 AM | Attr = ]
ARA18_09 -> %UserProfile%\My Documents\ARA18_09 -> [Folder | Created Date = 4/23/2008 11:25:32 AM | Attr = ]
ARA18_10 -> %UserProfile%\My Documents\ARA18_10 -> [Folder | Created Date = 4/23/2008 11:25:36 AM | Attr = ]
ARA19_01 -> %UserProfile%\My Documents\ARA19_01 -> [Folder | Created Date = 4/23/2008 11:25:40 AM | Attr = ]
ARA19_02 -> %UserProfile%\My Documents\ARA19_02 -> [Folder | Created Date = 4/23/2008 11:25:43 AM | Attr = ]
ARA19_03 -> %UserProfile%\My Documents\ARA19_03 -> [Folder | Created Date = 4/23/2008 11:25:47 AM | Attr = ]
ARA19_04 -> %UserProfile%\My Documents\ARA19_04 -> [Folder | Created Date = 4/23/2008 11:25:51 AM | Attr = ]
ARA19_05 -> %UserProfile%\My Documents\ARA19_05 -> [Folder | Created Date = 4/23/2008 11:25:58 AM | Attr = ]
ARA19_06 -> %UserProfile%\My Documents\ARA19_06 -> [Folder | Created Date = 4/23/2008 11:26:04 AM | Attr = ]
ARA19_07 -> %UserProfile%\My Documents\ARA19_07 -> [Folder | Created Date = 4/23/2008 11:26:11 AM | Attr = ]
ARA19_08 -> %UserProfile%\My Documents\ARA19_08 -> [Folder | Created Date = 4/23/2008 11:26:17 AM | Attr = ]
ARA19_09 -> %UserProfile%\My Documents\ARA19_09 -> [Folder | Created Date = 4/23/2008 11:26:20 AM | Attr = ]
ARA19_10 -> %UserProfile%\My Documents\ARA19_10 -> [Folder | Created Date = 4/23/2008 11:26:22 AM | Attr = ]
AutoRunSource -> %UserProfile%\My Documents\AutoRunSource -> [Folder | Created Date = 4/23/2008 11:26:26 AM | Attr = ]
backups -> %UserProfile%\My Documents\backups -> [Folder | Created Date = 4/23/2008 2:11:03 AM | Attr = ]
CHI01_01 -> %UserProfile%\My Documents\CHI01_01 -> [Folder | Created Date = 4/23/2008 11:26:26 AM | Attr = ]
CHI01_02 -> %UserProfile%\My Documents\CHI01_02 -> [Folder | Created Date = 4/23/2008 11:26:29 AM | Attr = ]
CHI01_03 -> %UserProfile%\My Documents\CHI01_03 -> [Folder | Created Date = 4/23/2008 11:26:32 AM | Attr = ]
CHI01_04 -> %UserProfile%\My Documents\CHI01_04 -> [Folder | Created Date = 4/23/2008 11:26:34 AM | Attr = ]
CHI01_05 -> %UserProfile%\My Documents\CHI01_05 -> [Folder | Created Date = 4/23/2008 11:26:36 AM | Attr = ]
CHI01_06 -> %UserProfile%\My Documents\CHI01_06 -> [Folder | Created Date = 4/23/2008 11:26:40 AM | Attr = ]
CHI01_07 -> %UserProfile%\My Documents\CHI01_07 -> [Folder | Created Date = 4/23/2008 11:26:43 AM | Attr = ]
CHI01_08 -> %UserProfile%\My Documents\CHI01_08 -> [Folder | Created Date = 4/23/2008 11:26:47 AM | Attr = ]
CHI01_09 -> %UserProfile%\My Documents\CHI01_09 -> [Folder | Created Date = 4/23/2008 11:26:49 AM | Attr = ]
CHI01_10 -> %UserProfile%\My Documents\CHI01_10 -> [Folder | Created Date = 4/23/2008 11:26:52 AM | Attr = ]
CHI01_11 -> %UserProfile%\My Documents\CHI01_11 -> [Folder | Created Date = 4/23/2008 11:26:55 AM | Attr = ]
CHI02_01 -> %UserProfile%\My Documents\CHI02_01 -> [Folder | Created Date = 4/23/2008 11:26:59 AM | Attr = ]
CHI02_02 -> %UserProfile%\My Documents\CHI02_02 -> [Folder | Created Date = 4/23/2008 11:27:02 AM | Attr = ]
CHI02_03 -> %UserProfile%\My Documents\CHI02_03 -> [Folder | Created Date = 4/23/2008 11:27:06 AM | Attr = ]
CHI02_04 -> %UserProfile%\My Documents\CHI02_04 -> [Folder | Created Date = 4/23/2008 11:27:08 AM | Attr = ]
CHI02_05 -> %UserProfile%\My Documents\CHI02_05 -> [Folder | Created Date = 4/23/2008 11:27:13 AM | Attr = ]
CHI02_06 -> %UserProfile%\My Documents\CHI02_06 -> [Folder | Created Date = 4/23/2008 11:27:16 AM | Attr = ]
CHI02_07 -> %UserProfile%\My Documents\CHI02_07 -> [Folder | Created Date = 4/23/2008 11:27:19 AM | Attr = ]
CHI02_08 -> %UserProfile%\My Documents\CHI02_08 -> [Folder | Created Date = 4/23/2008 11:27:23 AM | Attr = ]
CHI02_09 -> %UserProfile%\My Documents\CHI02_09 -> [Folder | Created Date = 4/23/2008 11:27:24 AM | Attr = ]
CHI02_10 -> %UserProfile%\My Documents\CHI02_10 -> [Folder | Created Date = 4/23/2008 11:27:26 AM | Attr = ]
CHI02_11 -> %UserProfile%\My Documents\CHI02_11 -> [Folder | Created Date = 4/23/2008 11:27:28 AM | Attr = ]
CHI03_01 -> %UserProfile%\My Documents\CHI03_01 -> [Folder | Created Date = 4/23/2008 11:27:30 AM | Attr = ]
CHI03_02 -> %UserProfile%\My Documents\CHI03_02 -> [Folder | Created Date = 4/23/2008 11:27:32 AM | Attr = ]
CHI03_03 -> %UserProfile%\My Documents\CHI03_03 -> [Folder | Created Date = 4/23/2008 11:27:34 AM | Attr = ]
CHI03_04 -> %UserProfile%\My Documents\CHI03_04 -> [Folder | Created Date = 4/23/2008 11:27:36 AM | Attr = ]
CHI03_05 -> %UserProfile%\My Documents\CHI03_05 -> [Folder | Created Date = 4/23/2008 11:27:39 AM | Attr = ]
CHI03_06 -> %UserProfile%\My Documents\CHI03_06 -> [Folder | Created Date = 4/23/2008 11:27:41 AM | Attr = ]
CHI03_07 -> %UserProfile%\My Documents\CHI03_07 -> [Folder | Created Date = 4/23/2008 11:27:43 AM | Attr = ]
CHI03_08 -> %UserProfile%\My Documents\CHI03_08 -> [Folder | Created Date = 4/23/2008 11:27:45 AM | Attr = ]
CHI03_09 -> %UserProfile%\My Documents\CHI03_09 -> [Folder | Created Date = 4/23/2008 11:27:47 AM | Attr = ]
CHI03_10 -> %UserProfile%\My Documents\CHI03_10 -> [Folder | Created Date = 4/23/2008 11:27:50 AM | Attr = ]
CHI03_11 -> %UserProfile%\My Documents\CHI03_11 -> [Folder | Created Date = 4/23/2008 11:27:52 AM | Attr = ]
CHI04_01 -> %UserProfile%\My Documents\CHI04_01 -> [Folder | Created Date = 4/23/2008 11:27:54 AM | Attr = ]
CHI04_02 -> %UserProfile%\My Documents\CHI04_02 -> [Folder | Created Date = 4/23/2008 11:27:58 AM | Attr = ]
CHI04_03 -> %UserProfile%\My Documents\CHI04_03 -> [Folder | Created Date = 4/23/2008 11:28:02 AM | Attr = ]
CHI04_04 -> %UserProfile%\My Documents\CHI04_04 -> [Folder | Created Date = 4/23/2008 11:28:15 AM | Attr = ]
CHI04_05 -> %UserProfile%\My Documents\CHI04_05 -> [Folder | Created Date = 4/23/2008 11:28:18 AM | Attr = ]
CHI04_06 -> %UserProfile%\My Documents\CHI04_06 -> [Folder | Created Date = 4/23/2008 11:28:22 AM | Attr = ]
CHI04_07 -> %UserProfile%\My Documents\CHI04_07 -> [Folder | Created Date = 4/23/2008 11:28:27 AM | Attr = ]
CHI04_08 -> %UserProfile%\My Documents\CHI04_08 -> [Folder | Created Date = 4/23/2008 11:28:31 AM | Attr = ]
CHI04_09 -> %UserProfile%\My Documents\CHI04_09 -> [Folder | Created Date = 4/23/2008 11:28:34 AM | Attr = ]
CHI04_10 -> %UserProfile%\My Documents\CHI04_10 -> [Folder | Created Date = 4/23/2008 11:28:38 AM | Attr = ]
CHI04_11 -> %UserProfile%\My Documents\CHI04_11 -> [Folder | Created Date = 4/23/2008 11:28:42 AM | Attr = ]
CHI05_01 -> %UserProfile%\My Documents\CHI05_01 -> [Folder | Created Date = 4/23/2008 11:28:45 AM | Attr = ]
CHI05_02 -> %UserProfile%\My Documents\CHI05_02 -> [Folder | Created Date = 4/23/2008 11:28:49 AM | Attr = ]
CHI05_03 -> %UserProfile%\My Documents\CHI05_03 -> [Folder | Created Date = 4/23/2008 11:28:52 AM | Attr = ]
CHI05_04 -> %UserProfile%\My Documents\CHI05_04 -> [Folder | Created Date = 4/23/2008 11:28:56 AM | Attr = ]
CHI05_05 -> %UserProfile%\My Documents\CHI05_05 -> [Folder | Created Date = 4/23/2008 11:29:00 AM | Attr = ]
CHI05_06 -> %UserProfile%\My Documents\CHI05_06 -> [Folder | Created Date = 4/23/2008 11:29:03 AM | Attr = ]
CHI05_07 -> %UserProfile%\My Documents\CHI05_07 -> [Folder | Created Date = 4/23/2008 11:29:07 AM | Attr = ]
CHI05_08 -> %UserProfile%\My Documents\CHI05_08 -> [Folder | Created Date = 4/23/2008 11:29:10 AM | Attr = ]
CHI05_09 -> %UserProfile%\My Documents\CHI05_09 -> [Folder | Created Date = 4/23/2008 11:29:15 AM | Attr = ]
CHI05_10 -> %UserProfile%\My Documents\CHI05_10 -> [Folder | Created Date = 4/23/2008 11:29:20 AM | Attr = ]
CHI05_11 -> %UserProfile%\My Documents\CHI05_11 -> [Folder | Created Date = 4/23/2008 11:29:24 AM | Attr = ]
CHI05_12 -> %UserProfile%\My Documents\CHI05_12 -> [Folder | Created Date = 4/23/2008 11:29:29 AM | Attr = ]
CHI06_01 -> %UserProfile%\My Documents\CHI06_01 -> [Folder | Created Date = 4/23/2008 11:29:32 AM | Attr = ]
CHI06_02 -> %UserProfile%\My Documents\CHI06_02 -> [Folder | Created Date = 4/23/2008 11:29:37 AM | Attr = ]
CHI06_03 -> %UserProfile%\My Documents\CHI06_03 -> [Folder | Created Date = 4/23/2008 11:29:42 AM | Attr = ]
CHI06_04 -> %UserProfile%\My Documents\CHI06_04 -> [Folder | Created Date = 4/23/2008 11:29:46 AM | Attr = ]
CHI06_05 -> %UserProfile%\My Documents\CHI06_05 -> [Folder | Created Date = 4/23/2008 11:29:52 AM | Attr = ]
CHI06_06 -> %UserProfile%\My Documents\CHI06_06 -> [Folder | Created Date = 4/23/2008 11:29:58 AM | Attr = ]
CHI06_07 -> %UserProfile%\My Documents\CHI06_07 -> [Folder | Created Date = 4/23/2008 11:30:02 AM | Attr = ]
CHI06_08 -> %UserProfile%\My Documents\CHI06_08 -> [Folder | Created Date = 4/23/2008 11:30:05 AM | Attr = ]
CHI06_09 -> %UserProfile%\My Documents\CHI06_09 -> [Folder | Created Date = 4/23/2008 11:30:09 AM | Attr = ]
CHI06_10 -> %UserProfile%\My Documents\CHI06_10 -> [Folder | Created Date = 4/23/2008 11:30:14 AM | Attr = ]
CHI06_11 -> %UserProfile%\My Documents\CHI06_11 -> [Folder | Created Date = 4/23/2008 11:30:18 AM | Attr = ]
CHI06_12 -> %UserProfile%\My Documents\CHI06_12 -> [Folder | Created Date = 4/23/2008 11:30:22 AM | Attr = ]
CHI07_01 -> %UserProfile%\My Documents\CHI07_01 -> [Folder | Created Date = 4/23/2008 11:30:29 AM | Attr = ]
CHI07_02 -> %UserProfile%\My Documents\CHI07_02 -> [Folder | Created Date = 4/23/2008 11:30:36 AM | Attr = ]
CHI07_03 -> %UserProfile%\My Documents\CHI07_03 -> [Folder | Created Date = 4/23/2008 11:30:39 AM | Attr = ]
CHI07_04 -> %UserProfile%\My Documents\CHI07_04 -> [Folder | Created Date = 4/23/2008 11:30:45 AM | Attr = ]
CHI07_05 -> %UserProfile%\My Documents\CHI07_05 -> [Folder | Created Date = 4/23/2008 11:30:49 AM | Attr = ]
CHI07_06 -> %UserProfile%\My Documents\CHI07_06 -> [Folder | Created Date = 4/23/2008 11:30:54 AM | Attr = ]
CHI07_07 -> %UserProfile%\My Documents\CHI07_07 -> [Folder | Created Date = 4/23/2008 11:30:57 AM | Attr = ]
CHI07_08 -> %UserProfile%\My Documents\CHI07_08 -> [Folder | Created Date = 4/23/2008 11:31:01 AM | Attr = ]
CHI07_09 -> %UserProfile%\My Documents\CHI07_09 -> [Folder | Created Date = 4/23/2008 11:31:05 AM | Attr = ]
CHI07_10 -> %UserProfile%\My Documents\CHI07_10 -> [Folder | Created Date = 4/23/2008 11:31:10 AM | Attr = ]
CHI07_11 -> %UserProfile%\My Documents\CHI07_11 -> [Folder | Created Date = 4/23/2008 11:31:15 AM | Attr = ]
CHI07_12 -> %UserProfile%\My Documents\CHI07_12 -> [Folder | Created Date = 4/23/2008 11:31:19 AM | Attr = ]
CHI08_01 -> %UserProfile%\My Documents\CHI08_01 -> [Folder | Created Date = 4/23/2008 11:31:23 AM | Attr = ]
CHI08_02 -> %UserProfile%\My Documents\CHI08_02 -> [Folder | Created Date = 4/23/2008 11:31:28 AM | Attr = ]
CHI08_03 -> %UserProfile%\My Documents\CHI08_03 -> [Folder | Created Date = 4/23/2008 11:31:31 AM | Attr = ]
CHI08_04 -> %UserProfile%\My Documents\CHI08_04 -> [Folder | Created Date = 4/23/2008 11:31:34 AM | Attr = ]
CHI08_05 -> %UserProfile%\My Documents\CHI08_05 -> [Folder | Created Date = 4/23/2008 11:31:38 AM | Attr = ]
CHI08_06 -> %UserProfile%\My Documents\CHI08_06 -> [Folder | Created Date = 4/23/2008 11:31:41 AM | Attr = ]
CHI08_07 -> %UserProfile%\My Documents\CHI08_07 -> [Folder | Created Date = 4/23/2008 11:31:45 AM | Attr = ]
CHI08_08 -> %UserProfile%\My Documents\CHI08_08 -> [Folder | Created Date = 4/23/2008 11:31:49 AM | Attr = ]
CHI08_09 -> %UserProfile%\My Documents\CHI08_09 -> [Folder | Created Date = 4/23/2008 11:31:52 AM | Attr = ]
CHI08_10 -> %UserProfile%\My Documents\CHI08_10 -> [Folder | Created Date = 4/23/2008 11:31:57 AM | Attr = ]
CHI08_11 -> %UserProfile%\My Documents\CHI08_11 -> [Folder | Created Date = 4/23/2008 11:32:01 AM | Attr = ]
CHI08_12 -> %UserProfile%\My Documents\CHI08_12 -> [Folder | Created Date = 4/23/2008 11:32:05 AM | Attr = ]
CHI09_01 -> %UserProfile%\My Documents\CHI09_01 -> [Folder | Created Date = 4/23/2008 11:32:09 AM | Attr = ]
CHI09_02 -> %UserProfile%\My Documents\CHI09_02 -> [Folder | Created Date = 4/23/2008 11:32:13 AM | Attr = ]
CHI09_03 -> %UserProfile%\My Documents\CHI09_03 -> [Folder | Created Date = 4/23/2008 11:32:17 AM | Attr = ]
CHI09_04 -> %UserProfile%\My Documents\CHI09_04 -> [Folder | Created Date = 4/23/2008 11:32:21 AM | Attr = ]
CHI09_05 -> %UserProfile%\My Documents\CHI09_05 -> [Folder | Created Date = 4/23/2008 11:32:25 AM | Attr = ]
CHI09_06 -> %UserProfile%\My Documents\CHI09_06 -> [Folder | Created Date = 4/23/2008 11:32:30 AM | Attr = ]
CHI09_07 -> %UserProfile%\My Documents\CHI09_07 -> [Folder | Created Date = 4/23/2008 11:32:33 AM | Attr = ]
CHI09_08 -> %UserProfile%\My Documents\CHI09_08 -> [Folder | Created Date = 4/23/2008 11:32:37 AM | Attr = ]
CHI09_09 -> %UserProfile%\My Documents\CHI09_09 -> [Folder | Created Date = 4/23/2008 11:32:42 AM | Attr = ]
CHI09_10 -> %UserProfile%\My Documents\CHI09_10 -> [Folder | Created Date = 4/23/2008 11:32:45 AM | Attr = ]
CHI09_11 -> %UserProfile%\My Documents\CHI09_11 -> [Folder | Created Date = 4/23/2008 11:32:50 AM | Attr = ]
CHI10_01 -> %UserProfile%\My Documents\CHI10_01 -> [Folder | Created Date = 4/23/2008 11:32:54 AM | Attr = ]
CHI10_02 -> %UserProfile%\My Documents\CHI10_02 -> [Folder | Created Date = 4/23/2008 11:32:59 AM | Attr = ]
CHI10_03 -> %UserProfile%\My Documents\CHI10_03 -> [Folder | Created Date = 4/23/2008 11:33:03 AM | Attr = ]
CHI10_04 -> %UserProfile%\My Documents\CHI10_04 -> [Folder | Created Date = 4/23/2008 11:33:08 AM | Attr = ]
CHI10_05 -> %UserProfile%\My Documents\CHI10_05 -> [Folder | Created Date = 4/23/2008 11:33:11 AM | Attr = ]
CHI10_06 -> %UserProfile%\My Documents\CHI10_06 -> [Folder | Created Date = 4/23/2008 11:33:13 AM | Attr = ]
CHI10_07 -> %UserProfile%\My Documents\CHI10_07 -> [Folder | Created Date = 4/23/2008 11:33:19 AM | Attr = ]
CHI10_08 -> %UserProfile%\My Documents\CHI10_08 -> [Folder | Created Date = 4/23/2008 11:33:24 AM | Attr = ]
CHI10_09 -> %UserProfile%\My Documents\CHI10_09 -> [Folder | Created Date = 4/23/2008 11:33:29 AM | Attr = ]
CHI10_10 -> %UserProfile%\My Documents\CHI10_10 -> [Folder | Created Date = 4/23/2008 11:33:33 AM | Attr = ]
CHI10_11 -> %UserProfile%\My Documents\CHI10_11 -> [Folder | Created Date = 4/23/2008 11:33:37 AM | Attr = ]
CHI11_01 -> %UserProfile%\My Documents\CHI11_01 -> [Folder | Created Date = 4/23/2008 11:33:40 AM | Attr = ]
CHI11_02 -> %UserProfile%\My Documents\CHI11_02 -> [Folder | Created Date = 4/23/2008 11:33:45 AM | Attr = ]
CHI11_03 -> %UserProfile%\My Documents\CHI11_03 -> [Folder | Created Date = 4/23/2008 11:33:49 AM | Attr = ]
CHI11_04 -> %UserProfile%\My Documents\CHI11_04 -> [Folder | Created Date = 4/23/2008 11:33:53 AM | Attr = ]
CHI11_05 -> %UserProfile%\My Documents\CHI11_05 -> [Folder | Created Date = 4/23/2008 11:33:57 AM | Attr = ]
CHI11_06 -> %UserProfile%\My Documents\CHI11_06 -> [Folder | Created Date = 4/23/2008 11:34:01 AM | Attr = ]
CHI11_07 -> %UserProfile%\My Documents\CHI11_07 -> [Folder | Created Date = 4/23/2008 11:34:06 AM | Attr = ]
CHI11_08 -> %UserProfile%\My Documents\CHI11_08 -> [Folder | Created Date = 4/23/2008 11:34:10 AM | Attr = ]
CHI11_09 -> %UserProfile%\My Documents\CHI11_09 -> [Folder | Created Date = 4/23/2008 11:34:15 AM | Attr = ]
CHI11_10 -> %UserProfile%\My Documents\CHI11_10 -> [Folder | Created Date = 4/23/2008 11:34:19 AM | Attr = ]
CHI11_11 -> %UserProfile%\My Documents\CHI11_11 -> [Folder | Created Date = 4/23/2008 11:34:23 AM | Attr = ]
CHI12_01 -> %UserProfile%\My Documents\CHI12_01 -> [Folder | Created Date = 4/23/2008 11:34:27 AM | Attr = ]
CHI12_02 -> %UserProfile%\My Documents\CHI12_02 -> [Folder | Created Date = 4/23/2008 11:34:32 AM | Attr = ]
CHI12_03 -> %UserProfile%\My Documents\CHI12_03 -> [Folder | Created Date = 4/23/2008 11:34:37 AM | Attr = ]
CHI12_04 -> %UserProfile%\My Documents\CHI12_04 -> [Folder | Created Date = 4/23/2008 11:34:41 AM | Attr = ]
CHI12_05 -> %UserProfile%\My Documents\CHI12_05 -> [Folder | Created Date = 4/23/2008 11:34:45 AM | Attr = ]
CHI12_06 -> %UserProfile%\My Documents\CHI12_06 -> [Folder | Created Date = 4/23/2008 11:34:49 AM | Attr = ]
CHI12_07 -> %UserProfile%\My Documents\CHI12_07 -> [Folder | Created Date = 4/23/2008 11:34:54 AM | Attr = ]
CHI12_08 -> %UserProfile%\My Documents\CHI12_08 -> [Folder | Created Date = 4/23/2008 11:34:58 AM | Attr = ]
CHI12_09 -> %UserProfile%\My Documents\CHI12_09 -> [Folder | Created Date = 4/23/2008 11:35:05 AM | Attr = ]
CHI12_10 -> %UserProfile%\My Documents\CHI12_10 -> [Folder | Created Date = 4/23/2008 11:35:10 AM | Attr = ]
CHI12_11 -> %UserProfile%\My Documents\CHI12_11 -> [Folder | Created Date = 4/23/2008 11:35:18 AM | Attr = ]
CHI13_01 -> %UserProfile%\My Documents\CHI13_01 -> [Folder | Created Date = 4/23/2008 11:35:25 AM | Attr = ]
CHI13_02 -> %UserProfile%\My Documents\CHI13_02 -> [Folder | Created Date = 4/23/2008 11:35:31 AM | Attr = ]
CHI13_03 -> %UserProfile%\My Documents\CHI13_03 -> [Folder | Created Date = 4/23/2008 11:35:36 AM | Attr = ]
CHI13_04 -> %UserProfile%\My Documents\CHI13_04 -> [Folder | Created Date = 4/23/2008 11:35:41 AM | Attr = ]
CHI13_05 -> %UserProfile%\My Documents\CHI13_05 -> [Folder | Created Date = 4/23/2008 11:35:47 AM | Attr = ]
CHI13_06 -> %UserProfile%\My Documents\CHI13_06 -> [Folder | Created Date = 4/23/2008 11:35:54 AM | Attr = ]
CHI13_07 -> %UserProfile%\My Documents\CHI13_07 -> [Folder | Created Date = 4/23/2008 11:36:00 AM | Attr = ]
CHI13_08 -> %UserProfile%\My Documents\CHI13_08 -> [Folder | Created Date = 4/23/2008 11:36:05 AM | Attr = ]
CHI13_09 -> %UserProfile%\My Documents\CHI13_09 -> [Folder | Created Date = 4/23/2008 11:36:10 AM | Attr = ]
CHI13_10 -> %UserProfile%\My Documents\CHI13_10 -> [Folder | Created Date = 4/23/2008 11:36:17 AM | Attr = ]
CHI13_11 -> %UserProfile%\My Documents\CHI13_11 -> [Folder | Created Date = 4/23/2008 11:36:23 AM | Attr = ]
CHI14_01 -> %UserProfile%\My Documents\CHI14_01 -> [Folder | Created Date = 4/23/2008 11:36:27 AM | Attr = ]
CHI14_02 -> %UserProfile%\My Documents\CHI14_02 -> [Folder | Created Date = 4/23/2008 11:36:32 AM | Attr = ]
CHI14_03 -> %UserProfile%\My Documents\CHI14_03 -> [Folder | Created Date = 4/23/2008 11:36:37 AM | Attr = ]
CHI14_04 -> %UserProfile%\My Documents\CHI14_04 -> [Folder | Created Date = 4/23/2008 11:36:44 AM | Attr = ]
CHI14_05 -> %UserProfile%\My Documents\CHI14_05 -> [Folder | Created Date = 4/23/2008 11:36:53 AM | Attr = ]
CHI14_06 -> %UserProfile%\My Documents\CHI14_06 -> [Folder | Created Date = 4/23/2008 11:37:00 AM | Attr = ]
CHI14_07 -> %UserProfile%\My Documents\CHI14_07 -> [Folder | Created Date = 4/23/2008 11:37:05 AM | Attr = ]
CHI14_08 -> %UserProfile%\My Documents\CHI14_08 -> [Folder | Created Date = 4/23/2008 11:37:10 AM | Attr = ]
CHI14_09 -> %UserProfile%\My Documents\CHI14_09 -> [Folder | Created Date = 4/23/2008 11:37:16 AM | Attr = ]
CHI14_10 -> %UserProfile%\My Documents\CHI14_10 -> [Folder | Created Date = 4/23/2008 11:37:20 AM | Attr = ]
CHI14_11 -> %UserProfile%\My Documents\CHI14_11 -> [Folder | Created Date = 4/23/2008 11:37:25 AM | Attr = ]
CHI15_01 -> %UserProfile%\My Documents\CHI15_01 -> [Folder | Created Date = 4/23/2008 11:37:30 AM | Attr = ]
CHI15_02 -> %UserProfile%\My Documents\CHI15_02 -> [Folder | Created Date = 4/23/2008 11:37:39 AM | Attr = ]
CHI15_03 -> %UserProfile%\My Documents\CHI15_03 -> [Folder | Created Date = 4/23/2008 11:37:46 AM | Attr = ]
CHI15_04 -> %UserProfile%\My Documents\CHI15_04 -> [Folder | Created Date = 4/23/2008 11:37:51 AM | Attr = ]
CHI15_05 -> %UserProfile%\My Documents\CHI15_05 -> [Folder | Created Date = 4/23/2008 11:37:55 AM | Attr = ]
CHI15_06 -> %UserProfile%\My Documents\CHI15_06 -> [Folder | Created Date = 4/23/2008 11:37:59 AM | Attr = ]
CHI15_07 -> %UserProfile%\My Documents\CHI15_07 -> [Folder | Created Date = 4/23/2008 11:38:03 AM | Attr = ]
CHI15_08 -> %UserProfile%\My Documents\CHI15_08 -> [Folder | Created Date = 4/23/2008 11:38:08 AM | Attr = ]
CHI15_09 -> %UserProfile%\My Documents\CHI15_09 -> [Folder | Created Date = 4/23/2008 11:38:13 AM | Attr = ]
CHI15_10 -> %UserProfile%\My Documents\CHI15_10 -> [Folder | Created Date = 4/23/2008 11:38:17 AM | Attr = ]
CHI15_11 -> %UserProfile%\My Documents\CHI15_11 -> [Folder | Created Date = 4/23/2008 11:38:22 AM | Attr = ]
CHI16_01 -> %UserProfile%\My Documents\CHI16_01 -> [Folder | Created Date = 4/23/2008 11:38:26 AM | Attr = ]
CHI16_02 -> %UserProfile%\My Documents\CHI16_02 -> [Folder | Created Date = 4/23/2008 11:38:30 AM | Attr = ]
CHI16_03

#15
helpme?

Posted 24 April 2008 - 08:37 PM

Member

Topic Starter
Member
46 posts

desktop.ini -> %UserProfile%\My Documents\desktop.ini -> [Ver = | Size = 86 bytes | Created Date = 4/14/2008 4:43:51 PM | Attr = HS]
DEU01_01 -> %UserProfile%\My Documents\DEU01_01 -> [Folder | Created Date = 4/23/2008 11:57:54 AM | Attr = ]
DEU01_02 -> %UserProfile%\My Documents\DEU01_02 -> [Folder | Created Date = 4/23/2008 11:58:00 AM | Attr = ]
DEU01_03 -> %UserProfile%\My Documents\DEU01_03 -> [Folder | Created Date = 4/23/2008 11:58:05 AM | Attr = ]
DEU01_04 -> %UserProfile%\My Documents\DEU01_04 -> [Folder | Created Date = 4/23/2008 11:58:09 AM | Attr = ]
DEU01_05 -> %UserProfile%\My Documents\DEU01_05 -> [Folder | Created Date = 4/23/2008 11:58:14 AM | Attr = ]
DEU01_06 -> %UserProfile%\My Documents\DEU01_06 -> [Folder | Created Date = 4/23/2008 11:58:19 AM | Attr = ]
DEU01_07 -> %UserProfile%\My Documents\DEU01_07 -> [Folder | Created Date = 4/23/2008 11:58:24 AM | Attr = ]
DEU01_08 -> %UserProfile%\My Documents\DEU01_08 -> [Folder | Created Date = 4/23/2008 11:58:28 AM | Attr = ]
DEU01_09 -> %UserProfile%\My Documents\DEU01_09 -> [Folder | Created Date = 4/23/2008 11:58:32 AM | Attr = ]
DEU01_10 -> %UserProfile%\My Documents\DEU01_10 -> [Folder | Created Date = 4/23/2008 11:58:39 AM | Attr = ]
DEU01_11 -> %UserProfile%\My Documents\DEU01_11 -> [Folder | Created Date = 4/23/2008 11:58:45 AM | Attr = ]
DEU02_01 -> %UserProfile%\My Documents\DEU02_01 -> [Folder | Created Date = 4/23/2008 11:58:51 AM | Attr = ]
DEU02_02 -> %UserProfile%\My Documents\DEU02_02 -> [Folder | Created Date = 4/23/2008 11:58:57 AM | Attr = ]
DEU02_03 -> %UserProfile%\My Documents\DEU02_03 -> [Folder | Created Date = 4/23/2008 11:59:02 AM | Attr = ]
DEU02_04 -> %UserProfile%\My Documents\DEU02_04 -> [Folder | Created Date = 4/23/2008 11:59:07 AM | Attr = ]
DEU02_05 -> %UserProfile%\My Documents\DEU02_05 -> [Folder | Created Date = 4/23/2008 11:59:11 AM | Attr = ]
DEU02_06 -> %UserProfile%\My Documents\DEU02_06 -> [Folder | Created Date = 4/23/2008 11:59:16 AM | Attr = ]
DEU02_07 -> %UserProfile%\My Documents\DEU02_07 -> [Folder | Created Date = 4/23/2008 11:59:21 AM | Attr = ]
DEU02_08 -> %UserProfile%\My Documents\DEU02_08 -> [Folder | Created Date = 4/23/2008 11:59:27 AM | Attr = ]
DEU02_09 -> %UserProfile%\My Documents\DEU02_09 -> [Folder | Created Date = 4/23/2008 11:59:33 AM | Attr = ]
DEU02_10 -> %UserProfile%\My Documents\DEU02_10 -> [Folder | Created Date = 4/23/2008 11:59:39 AM | Attr = ]
DEU02_11 -> %UserProfile%\My Documents\DEU02_11 -> [Folder | Created Date = 4/23/2008 11:59:45 AM | Attr = ]
DEU03_01 -> %UserProfile%\My Documents\DEU03_01 -> [Folder | Created Date = 4/23/2008 11:59:51 AM | Attr = ]
DEU03_02 -> %UserProfile%\My Documents\DEU03_02 -> [Folder | Created Date = 4/23/2008 11:59:57 AM | Attr = ]
DEU03_03 -> %UserProfile%\My Documents\DEU03_03 -> [Folder | Created Date = 4/23/2008 12:00:03 PM | Attr = ]
DEU03_04 -> %UserProfile%\My Documents\DEU03_04 -> [Folder | Created Date = 4/23/2008 12:00:08 PM | Attr = ]
DEU03_05 -> %UserProfile%\My Documents\DEU03_05 -> [Folder | Created Date = 4/23/2008 12:00:13 PM | Attr = ]
DEU03_06 -> %UserProfile%\My Documents\DEU03_06 -> [Folder | Created Date = 4/23/2008 12:00:17 PM | Attr = ]
DEU03_07 -> %UserProfile%\My Documents\DEU03_07 -> [Folder | Created Date = 4/23/2008 12:00:22 PM | Attr = ]
DEU03_08 -> %UserProfile%\My Documents\DEU03_08 -> [Folder | Created Date = 4/23/2008 12:00:27 PM | Attr = ]
DEU03_09 -> %UserProfile%\My Documents\DEU03_09 -> [Folder | Created Date = 4/23/2008 12:00:34 PM | Attr = ]
DEU03_10 -> %UserProfile%\My Documents\DEU03_10 -> [Folder | Created Date = 4/23/2008 12:00:39 PM | Attr = ]
DEU03_11 -> %UserProfile%\My Documents\DEU03_11 -> [Folder | Created Date = 4/23/2008 12:00:45 PM | Attr = ]
DEU04_01 -> %UserProfile%\My Documents\DEU04_01 -> [Folder | Created Date = 4/23/2008 12:00:50 PM | Attr = ]
DEU04_02 -> %UserProfile%\My Documents\DEU04_02 -> [Folder | Created Date = 4/23/2008 12:00:55 PM | Attr = ]
DEU04_03 -> %UserProfile%\My Documents\DEU04_03 -> [Folder | Created Date = 4/23/2008 12:01:00 PM | Attr = ]
DEU04_04 -> %UserProfile%\My Documents\DEU04_04 -> [Folder | Created Date = 4/23/2008 12:01:05 PM | Attr = ]
DEU04_05 -> %UserProfile%\My Documents\DEU04_05 -> [Folder | Created Date = 4/23/2008 12:01:12 PM | Attr = ]
DEU04_06 -> %UserProfile%\My Documents\DEU04_06 -> [Folder | Created Date = 4/23/2008 12:01:20 PM | Attr = ]
DEU04_07 -> %UserProfile%\My Documents\DEU04_07 -> [Folder | Created Date = 4/23/2008 12:01:25 PM | Attr = ]
DEU04_08 -> %UserProfile%\My Documents\DEU04_08 -> [Folder | Created Date = 4/23/2008 12:01:31 PM | Attr = ]
DEU04_09 -> %UserProfile%\My Documents\DEU04_09 -> [Folder | Created Date = 4/23/2008 12:01:37 PM | Attr = ]
DEU04_10 -> %UserProfile%\My Documents\DEU04_10 -> [Folder | Created Date = 4/23/2008 12:01:44 PM | Attr = ]
DEU04_11 -> %UserProfile%\My Documents\DEU04_11 -> [Folder | Created Date = 4/23/2008 12:01:49 PM | Attr = ]
DEU05_01 -> %UserProfile%\My Documents\DEU05_01 -> [Folder | Created Date = 4/23/2008 12:01:55 PM | Attr = ]
DEU05_02 -> %UserProfile%\My Documents\DEU05_02 -> [Folder | Created Date = 4/23/2008 12:02:01 PM | Attr = ]
DEU05_03 -> %UserProfile%\My Documents\DEU05_03 -> [Folder | Created Date = 4/23/2008 12:02:08 PM | Attr = ]
DEU05_04 -> %UserProfile%\My Documents\DEU05_04 -> [Folder | Created Date = 4/23/2008 12:02:14 PM | Attr = ]
DEU05_05 -> %UserProfile%\My Documents\DEU05_05 -> [Folder | Created Date = 4/23/2008 12:02:20 PM | Attr = ]
DEU05_06 -> %UserProfile%\My Documents\DEU05_06 -> [Folder | Created Date = 4/23/2008 12:02:25 PM | Attr = ]
DEU05_07 -> %UserProfile%\My Documents\DEU05_07 -> [Folder | Created Date = 4/23/2008 12:02:32 PM | Attr = ]
DEU05_08 -> %UserProfile%\My Documents\DEU05_08 -> [Folder | Created Date = 4/23/2008 12:02:38 PM | Attr = ]
DEU05_09 -> %UserProfile%\My Documents\DEU05_09 -> [Folder | Created Date = 4/23/2008 12:02:43 PM | Attr = ]
DEU05_10 -> %UserProfile%\My Documents\DEU05_10 -> [Folder | Created Date = 4/23/2008 12:02:49 PM | Attr = ]
DEU05_11 -> %UserProfile%\My Documents\DEU05_11 -> [Folder | Created Date = 4/23/2008 12:02:54 PM | Attr = ]
DEU05_12 -> %UserProfile%\My Documents\DEU05_12 -> [Folder | Created Date = 4/23/2008 12:03:00 PM | Attr = ]
DEU06_01 -> %UserProfile%\My Documents\DEU06_01 -> [Folder | Created Date = 4/23/2008 12:03:05 PM | Attr = ]
DEU06_02 -> %UserProfile%\My Documents\DEU06_02 -> [Folder | Created Date = 4/23/2008 12:03:10 PM | Attr = ]
DEU06_03 -> %UserProfile%\My Documents\DEU06_03 -> [Folder | Created Date = 4/23/2008 12:03:16 PM | Attr = ]
DEU06_04 -> %UserProfile%\My Documents\DEU06_04 -> [Folder | Created Date = 4/23/2008 12:03:22 PM | Attr = ]
DEU06_05 -> %UserProfile%\My Documents\DEU06_05 -> [Folder | Created Date = 4/23/2008 12:03:28 PM | Attr = ]
DEU06_06 -> %UserProfile%\My Documents\DEU06_06 -> [Folder | Created Date = 4/23/2008 12:03:34 PM | Attr = ]
DEU06_07 -> %UserProfile%\My Documents\DEU06_07 -> [Folder | Created Date = 4/23/2008 12:03:40 PM | Attr = ]
DEU06_08 -> %UserProfile%\My Documents\DEU06_08 -> [Folder | Created Date = 4/23/2008 12:03:46 PM | Attr = ]
DEU06_09 -> %UserProfile%\My Documents\DEU06_09 -> [Folder | Created Date = 4/23/2008 12:03:50 PM | Attr = ]
DEU06_10 -> %UserProfile%\My Documents\DEU06_10 -> [Folder | Created Date = 4/23/2008 12:03:55 PM | Attr = ]
DEU06_11 -> %UserProfile%\My Documents\DEU06_11 -> [Folder | Created Date = 4/23/2008 12:04:01 PM | Attr = ]
DEU06_12 -> %UserProfile%\My Documents\DEU06_12 -> [Folder | Created Date = 4/23/2008 12:04:08 PM | Attr = ]
DEU07_01 -> %UserProfile%\My Documents\DEU07_01 -> [Folder | Created Date = 4/23/2008 12:04:15 PM | Attr = ]
DEU07_02 -> %UserProfile%\My Documents\DEU07_02 -> [Folder | Created Date = 4/23/2008 12:04:24 PM | Attr = ]
DEU07_03 -> %UserProfile%\My Documents\DEU07_03 -> [Folder | Created Date = 4/23/2008 12:04:31 PM | Attr = ]
DEU07_04 -> %UserProfile%\My Documents\DEU07_04 -> [Folder | Created Date = 4/23/2008 12:04:41 PM | Attr = ]
DEU07_05 -> %UserProfile%\My Documents\DEU07_05 -> [Folder | Created Date = 4/23/2008 12:04:47 PM | Attr = ]
DEU07_06 -> %UserProfile%\My Documents\DEU07_06 -> [Folder | Created Date = 4/23/2008 12:04:53 PM | Attr = ]
DEU07_07 -> %UserProfile%\My Documents\DEU07_07 -> [Folder | Created Date = 4/23/2008 12:04:59 PM | Attr = ]
DEU07_08 -> %UserProfile%\My Documents\DEU07_08 -> [Folder | Created Date = 4/23/2008 12:05:03 PM | Attr = ]
DEU07_09 -> %UserProfile%\My Documents\DEU07_09 -> [Folder | Created Date = 4/23/2008 12:05:07 PM | Attr = ]
DEU07_10 -> %UserProfile%\My Documents\DEU07_10 -> [Folder | Created Date = 4/23/2008 12:05:13 PM | Attr = ]
DEU07_11 -> %UserProfile%\My Documents\DEU07_11 -> [Folder | Created Date = 4/23/2008 12:05:19 PM | Attr = ]
DEU07_12 -> %UserProfile%\My Documents\DEU07_12 -> [Folder | Created Date = 4/23/2008 12:05:24 PM | Attr = ]
DEU08_01 -> %UserProfile%\My Documents\DEU08_01 -> [Folder | Created Date = 4/23/2008 12:05:31 PM | Attr = ]
DEU08_02 -> %UserProfile%\My Documents\DEU08_02 -> [Folder | Created Date = 4/23/2008 12:05:39 PM | Attr = ]
DEU08_03 -> %UserProfile%\My Documents\DEU08_03 -> [Folder | Created Date = 4/23/2008 12:05:44 PM | Attr = ]
DEU08_04 -> %UserProfile%\My Documents\DEU08_04 -> [Folder | Created Date = 4/23/2008 12:05:52 PM | Attr = ]
DEU08_05 -> %UserProfile%\My Documents\DEU08_05 -> [Folder | Created Date = 4/23/2008 12:05:59 PM | Attr = ]
DEU08_06 -> %UserProfile%\My Documents\DEU08_06 -> [Folder | Created Date = 4/23/2008 12:06:06 PM | Attr = ]
DEU08_07 -> %UserProfile%\My Documents\DEU08_07 -> [Folder | Created Date = 4/23/2008 12:06:13 PM | Attr = ]
DEU08_08 -> %UserProfile%\My Documents\DEU08_08 -> [Folder | Created Date = 4/23/2008 12:06:19 PM | Attr = ]
DEU08_09 -> %UserProfile%\My Documents\DEU08_09 -> [Folder | Created Date = 4/23/2008 12:06:26 PM | Attr = ]
DEU08_10 -> %UserProfile%\My Documents\DEU08_10 -> [Folder | Created Date = 4/23/2008 12:06:33 PM | Attr = ]
DEU08_11 -> %UserProfile%\My Documents\DEU08_11 -> [Folder | Created Date = 4/23/2008 12:06:41 PM | Attr = ]
DEU08_12 -> %UserProfile%\My Documents\DEU08_12 -> [Folder | Created Date = 4/23/2008 12:06:48 PM | Attr = ]
DEU09_01 -> %UserProfile%\My Documents\DEU09_01 -> [Folder | Created Date = 4/23/2008 12:06:54 PM | Attr = ]
DEU09_02 -> %UserProfile%\My Documents\DEU09_02 -> [Folder | Created Date = 4/23/2008 12:07:01 PM | Attr = ]
DEU09_03 -> %UserProfile%\My Documents\DEU09_03 -> [Folder | Created Date = 4/23/2008 12:07:11 PM | Attr = ]
DEU09_04 -> %UserProfile%\My Documents\DEU09_04 -> [Folder | Created Date = 4/23/2008 12:07:16 PM | Attr = ]
DEU09_05 -> %UserProfile%\My Documents\DEU09_05 -> [Folder | Created Date = 4/23/2008 12:07:22 PM | Attr = ]
DEU09_06 -> %UserProfile%\My Documents\DEU09_06 -> [Folder | Created Date = 4/23/2008 12:07:29 PM | Attr = ]
DEU09_07 -> %UserProfile%\My Documents\DEU09_07 -> [Folder | Created Date = 4/23/2008 12:07:35 PM | Attr = ]
DEU09_08 -> %UserProfile%\My Documents\DEU09_08 -> [Folder | Created Date = 4/23/2008 12:07:40 PM | Attr = ]
DEU09_09 -> %UserProfile%\My Documents\DEU09_09 -> [Folder | Created Date = 4/23/2008 12:07:45 PM | Attr = ]
DEU09_10 -> %UserProfile%\My Documents\DEU09_10 -> [Folder | Created Date = 4/23/2008 12:07:52 PM | Attr = ]
DEU09_11 -> %UserProfile%\My Documents\DEU09_11 -> [Folder | Created Date = 4/23/2008 12:07:59 PM | Attr = ]
DEU10_01 -> %UserProfile%\My Documents\DEU10_01 -> [Folder | Created Date = 4/23/2008 12:08:06 PM | Attr = ]
DEU10_02 -> %UserProfile%\My Documents\DEU10_02 -> [Folder | Created Date = 4/23/2008 12:08:13 PM | Attr = ]
DEU10_03 -> %UserProfile%\My Documents\DEU10_03 -> [Folder | Created Date = 4/23/2008 12:08:19 PM | Attr = ]
DEU10_04 -> %UserProfile%\My Documents\DEU10_04 -> [Folder | Created Date = 4/23/2008 12:08:27 PM | Attr = ]
DEU10_05 -> %UserProfile%\My Documents\DEU10_05 -> [Folder | Created Date = 4/23/2008 12:08:33 PM | Attr = ]
DEU10_06 -> %UserProfile%\My Documents\DEU10_06 -> [Folder | Created Date = 4/23/2008 12:08:41 PM | Attr = ]
DEU10_07 -> %UserProfile%\My Documents\DEU10_07 -> [Folder | Created Date = 4/23/2008 12:08:58 PM | Attr = ]
DEU10_08 -> %UserProfile%\My Documents\DEU10_08 -> [Folder | Created Date = 4/23/2008 12:09:09 PM | Attr = ]
DEU10_09 -> %UserProfile%\My Documents\DEU10_09 -> [Folder | Created Date = 4/23/2008 12:09:16 PM | Attr = ]
DEU10_10 -> %UserProfile%\My Documents\DEU10_10 -> [Folder | Created Date = 4/23/2008 12:09:24 PM | Attr = ]
DEU10_11 -> %UserProfile%\My Documents\DEU10_11 -> [Folder | Created Date = 4/23/2008 12:09:33 PM | Attr = ]
DEU11_01 -> %UserProfile%\My Documents\DEU11_01 -> [Folder | Created Date = 4/23/2008 12:09:42 PM | Attr = ]
DEU11_02 -> %UserProfile%\My Documents\DEU11_02 -> [Folder | Created Date = 4/23/2008 12:09:51 PM | Attr = ]
DEU11_03 -> %UserProfile%\My Documents\DEU11_03 -> [Folder | Created Date = 4/23/2008 12:09:57 PM | Attr = ]
DEU11_04 -> %UserProfile%\My Documents\DEU11_04 -> [Folder | Created Date = 4/23/2008 12:10:07 PM | Attr = ]
DEU11_05 -> %UserProfile%\My Documents\DEU11_05 -> [Folder | Created Date = 4/23/2008 12:10:16 PM | Attr = ]
DEU11_06 -> %UserProfile%\My Documents\DEU11_06 -> [Folder | Created Date = 4/23/2008 12:10:33 PM | Attr = ]
DEU11_07 -> %UserProfile%\My Documents\DEU11_07 -> [Folder | Created Date = 4/23/2008 12:10:47 PM | Attr = ]
DEU11_08 -> %UserProfile%\My Documents\DEU11_08 -> [Folder | Created Date = 4/23/2008 12:11:13 PM | Attr = ]
DEU11_09 -> %UserProfile%\My Documents\DEU11_09 -> [Folder | Created Date = 4/23/2008 12:11:20 PM | Attr = ]
DEU11_10 -> %UserProfile%\My Documents\DEU11_10 -> [Folder | Created Date = 4/23/2008 12:11:30 PM | Attr = ]
DEU11_11 -> %UserProfile%\My Documents\DEU11_11 -> [Folder | Created Date = 4/23/2008 12:11:40 PM | Attr = ]
DEU12_01 -> %UserProfile%\My Documents\DEU12_01 -> [Folder | Created Date = 4/23/2008 12:11:49 PM | Attr = ]
DEU12_02 -> %UserProfile%\My Documents\DEU12_02 -> [Folder | Created Date = 4/23/2008 12:12:01 PM | Attr = ]
DEU12_03 -> %UserProfile%\My Documents\DEU12_03 -> [Folder | Created Date = 4/23/2008 12:12:13 PM | Attr = ]
DEU12_04 -> %UserProfile%\My Documents\DEU12_04 -> [Folder | Created Date = 4/23/2008 12:12:23 PM | Attr = ]
DEU12_05 -> %UserProfile%\My Documents\DEU12_05 -> [Folder | Created Date = 4/23/2008 12:12:29 PM | Attr = ]
DEU12_06 -> %UserProfile%\My Documents\DEU12_06 -> [Folder | Created Date = 4/23/2008 12:12:37 PM | Attr = ]
DEU12_07 -> %UserProfile%\My Documents\DEU12_07 -> [Folder | Created Date = 4/23/2008 12:12:47 PM | Attr = ]
DEU12_08 -> %UserProfile%\My Documents\DEU12_08 -> [Folder | Created Date = 4/23/2008 12:12:59 PM | Attr = ]
DEU12_09 -> %UserProfile%\My Documents\DEU12_09 -> [Folder | Created Date = 4/23/2008 12:13:08 PM | Attr = ]
DEU12_10 -> %UserProfile%\My Documents\DEU12_10 -> [Folder | Created Date = 4/23/2008 12:13:14 PM | Attr = ]
DEU12_11 -> %UserProfile%\My Documents\DEU12_11 -> [Folder | Created Date = 4/23/2008 12:13:21 PM | Attr = ]
DEU13_01 -> %UserProfile%\My Documents\DEU13_01 -> [Folder | Created Date = 4/23/2008 12:13:28 PM | Attr = ]
DEU13_02 -> %UserProfile%\My Documents\DEU13_02 -> [Folder | Created Date = 4/23/2008 12:13:36 PM | Attr = ]
DEU13_03 -> %UserProfile%\My Documents\DEU13_03 -> [Folder | Created Date = 4/23/2008 12:13:42 PM | Attr = ]
DEU13_04 -> %UserProfile%\My Documents\DEU13_04 -> [Folder | Created Date = 4/23/2008 12:13:51 PM | Attr = ]
DEU13_05 -> %UserProfile%\My Documents\DEU13_05 -> [Folder | Created Date = 4/23/2008 12:13:59 PM | Attr = ]
DEU13_06 -> %UserProfile%\My Documents\DEU13_06 -> [Folder | Created Date = 4/23/2008 12:14:08 PM | Attr = ]
DEU13_07 -> %UserProfile%\My Documents\DEU13_07 -> [Folder | Created Date = 4/23/2008 12:14:16 PM | Attr = ]
DEU13_08 -> %UserProfile%\My Documents\DEU13_08 -> [Folder | Created Date = 4/23/2008 12:14:25 PM | Attr = ]
DEU13_09 -> %UserProfile%\My Documents\DEU13_09 -> [Folder | Created Date = 4/23/2008 12:14:34 PM | Attr = ]
DEU13_10 -> %UserProfile%\My Documents\DEU13_10 -> [Folder | Created Date = 4/23/2008 12:14:44 PM | Attr = ]
DEU13_11 -> %UserProfile%\My Documents\DEU13_11 -> [Folder | Created Date = 4/23/2008 12:14:56 PM | Attr = ]
DEU14_01 -> %UserProfile%\My Documents\DEU14_01 -> [Folder | Created Date = 4/23/2008 12:15:06 PM | Attr = ]
DEU14_02 -> %UserProfile%\My Documents\DEU14_02 -> [Folder | Created Date = 4/23/2008 12:15:14 PM | Attr = ]
DEU14_03 -> %UserProfile%\My Documents\DEU14_03 -> [Folder | Created Date = 4/23/2008 12:15:21 PM | Attr = ]
DEU14_04 -> %UserProfile%\My Documents\DEU14_04 -> [Folder | Created Date = 4/23/2008 12:15:29 PM | Attr = ]
DEU14_05 -> %UserProfile%\My Documents\DEU14_05 -> [Folder | Created Date = 4/23/2008 12:15:34 PM | Attr = ]
DEU14_06 -> %UserProfile%\My Documents\DEU14_06 -> [Folder | Created Date = 4/23/2008 12:15:42 PM | Attr = ]
DEU14_07 -> %UserProfile%\My Documents\DEU14_07 -> [Folder | Created Date = 4/23/2008 12:15:48 PM | Attr = ]
DEU14_08 -> %UserProfile%\My Documents\DEU14_08 -> [Folder | Created Date = 4/23/2008 12:15:55 PM | Attr = ]
DEU14_09 -> %UserProfile%\My Documents\DEU14_09 -> [Folder | Created Date = 4/23/2008 12:16:01 PM | Attr = ]
DEU14_10 -> %UserProfile%\My Documents\DEU14_10 -> [Folder | Created Date = 4/23/2008 12:16:20 PM | Attr = ]
DEU14_11 -> %UserProfile%\My Documents\DEU14_11 -> [Folder | Created Date = 4/23/2008 12:16:26 PM | Attr = ]
DEU15_01 -> %UserProfile%\My Documents\DEU15_01 -> [Folder | Created Date = 4/23/2008 12:16:40 PM | Attr = ]
DEU15_02 -> %UserProfile%\My Documents\DEU15_02 -> [Folder | Created Date = 4/23/2008 12:16:58 PM | Attr = ]
DEU15_03 -> %UserProfile%\My Documents\DEU15_03 -> [Folder | Created Date = 4/23/2008 12:17:25 PM | Attr = ]
DEU15_04 -> %UserProfile%\My Documents\DEU15_04 -> [Folder | Created Date = 4/23/2008 12:17:45 PM | Attr = ]
DEU15_05 -> %UserProfile%\My Documents\DEU15_05 -> [Folder | Created Date = 4/23/2008 12:18:04 PM | Attr = ]
DEU15_06 -> %UserProfile%\My Documents\DEU15_06 -> [Folder | Created Date = 4/23/2008 12:18:16 PM | Attr = ]
DEU15_07 -> %UserProfile%\My Documents\DEU15_07 -> [Folder | Created Date = 4/23/2008 12:18:29 PM | Attr = ]
DEU15_08 -> %UserProfile%\My Documents\DEU15_08 -> [Folder | Created Date = 4/23/2008 12:18:42 PM | Attr = ]
DEU15_09 -> %UserProfile%\My Documents\DEU15_09 -> [Folder | Created Date = 4/23/2008 12:18:52 PM | Attr = ]
DEU15_10 -> %UserProfile%\My Documents\DEU15_10 -> [Folder | Created Date = 4/23/2008 12:19:05 PM | Attr = ]
DEU15_11 -> %UserProfile%\My Documents\DEU15_11 -> [Folder | Created Date = 4/23/2008 12:19:19 PM | Attr = ]
DEU16_01 -> %UserProfile%\My Documents\DEU16_01 -> [Folder | Created Date = 4/23/2008 12:19:29 PM | Attr = ]
DEU16_02 -> %UserProfile%\My Documents\DEU16_02 -> [Folder | Created Date = 4/23/2008 12:19:44 PM | Attr = ]
DEU16_03 -> %UserProfile%\My Documents\DEU16_03 -> [Folder | Created Date = 4/23/2008 12:19:57 PM | Attr = ]
DEU16_04 -> %UserProfile%\My Documents\DEU16_04 -> [Folder | Created Date = 4/23/2008 12:20:09 PM | Attr = ]
DEU16_05 -> %UserProfile%\My Documents\DEU16_05 -> [Folder | Created Date = 4/23/2008 12:20:23 PM | Attr = ]
DEU16_06 -> %UserProfile%\My Documents\DEU16_06 -> [Folder | Created Date = 4/23/2008 12:20:32 PM | Attr = ]
DEU16_07 -> %UserProfile%\My Documents\DEU16_07 -> [Folder | Created Date = 4/23/2008 12:20:47 PM | Attr = ]
DEU16_08 -> %UserProfile%\My Documents\DEU16_08 -> [Folder | Created Date = 4/23/2008 12:21:00 PM | Attr = ]
DEU16_09 -> %UserProfile%\My Documents\DEU16_09 -> [Folder | Created Date = 4/23/2008 12:21:14 PM | Attr = ]
DEU16_10 -> %UserProfile%\My Documents\DEU16_10 -> [Folder | Created Date = 4/23/2008 12:21:27 PM | Attr = ]
DEU16_11 -> %UserProfile%\My Documents\DEU16_11 -> [Folder | Created Date = 4/23/2008 12:21:42 PM | Attr = ]
DEU17_01 -> %UserProfile%\My Documents\DEU17_01 -> [Folder | Created Date = 4/23/2008 12:21:55 PM | Attr = ]
DEU17_02 -> %UserProfile%\My Documents\DEU17_02 -> [Folder | Created Date = 4/23/2008 12:22:05 PM | Attr = ]
DEU17_03 -> %UserProfile%\My Documents\DEU17_03 -> [Folder | Created Date = 4/23/2008 12:22:19 PM | Attr = ]
DEU17_04 -> %UserProfile%\My Documents\DEU17_04 -> [Folder | Created Date = 4/23/2008 12:22:32 PM | Attr = ]
DEU17_05 -> %UserProfile%\My Documents\DEU17_05 -> [Folder | Created Date = 4/23/2008 12:22:46 PM | Attr = ]
DEU17_06 -> %UserProfile%\My Documents\DEU17_06 -> [Folder | Created Date = 4/23/2008 12:22:59 PM | Attr = ]
DEU17_07 -> %UserProfile%\My Documents\DEU17_07 -> [Folder | Created Date = 4/23/2008 12:23:13 PM | Attr = ]
DEU17_08 -> %UserProfile%\My Documents\DEU17_08 -> [Folder | Created Date = 4/23/2008 12:23:26 PM | Attr = ]
DEU17_09 -> %UserProfile%\My Documents\DEU17_09 -> [Folder | Created Date = 4/23/2008 12:23:38 PM | Attr = ]
DEU17_10 -> %UserProfile%\My Documents\DEU17_10 -> [Folder | Created Date = 4/23/2008 12:23:51 PM | Attr = ]
DEU18_01 -> %UserProfile%\My Documents\DEU18_01 -> [Folder | Created Date = 4/23/2008 12:24:05 PM | Attr = ]
DEU18_02 -> %UserProfile%\My Documents\DEU18_02 -> [Folder | Created Date = 4/23/2008 12:24:17 PM | Attr = ]
DEU18_03 -> %UserProfile%\My Documents\DEU18_03 -> [Folder | Created Date = 4/23/2008 12:24:25 PM | Attr = ]
DEU18_04 -> %UserProfile%\My Documents\DEU18_04 -> [Folder | Created Date = 4/23/2008 12:24:34 PM | Attr = ]
DEU18_05 -> %UserProfile%\My Documents\DEU18_05 -> [Folder | Created Date = 4/23/2008 12:24:42 PM | Attr = ]
DEU18_06 -> %UserProfile%\My Documents\DEU18_06 -> [Folder | Created Date = 4/23/2008 12:24:53 PM | Attr = ]
DEU18_07 -> %UserProfile%\My Documents\DEU18_07 -> [Folder | Created Date = 4/23/2008 12:25:01 PM | Attr = ]
DEU18_08 -> %UserProfile%\My Documents\DEU18_08 -> [Folder | Created Date = 4/23/2008 12:25:12 PM | Attr = ]
DEU18_09 -> %UserProfile%\My Documents\DEU18_09 -> [Folder | Created Date = 4/23/2008 12:25:18 PM | Attr = ]
DEU18_10 -> %UserProfile%\My Documents\DEU18_10 -> [Folder | Created Date = 4/23/2008 12:25:30 PM | Attr = ]
DEU19_01 -> %UserProfile%\My Documents\DEU19_01 -> [Folder | Created Date = 4/23/2008 12:25:37 PM | Attr = ]
DEU19_02 -> %UserProfile%\My Documents\DEU19_02 -> [Folder | Created Date = 4/23/2008 12:25:45 PM | Attr = ]
DEU19_03 -> %UserProfile%\My Documents\DEU19_03 -> [Folder | Created Date = 4/23/2008 12:25:52 PM | Attr = ]
DEU19_04 -> %UserProfile%\My Documents\DEU19_04 -> [Folder | Created Date = 4/23/2008 12:25:58 PM | Attr = ]
DEU19_05 -> %UserProfile%\My Documents\DEU19_05 -> [Folder | Created Date = 4/23/2008 12:26:05 PM | Attr = ]
DEU19_06 -> %UserProfile%\My Documents\DEU19_06 -> [Folder | Created Date = 4/23/2008 12:26:16 PM | Attr = ]
DEU19_07 -> %UserProfile%\My Documents\DEU19_07 -> [Folder | Created Date = 4/23/2008 12:26:22 PM | Attr = ]
DEU19_08 -> %UserProfile%\My Documents\DEU19_08 -> [Folder | Created Date = 4/23/2008 12:26:28 PM | Attr = ]
DEU19_09 -> %UserProfile%\My Documents\DEU19_09 -> [Folder | Created Date = 4/23/2008 12:26:34 PM | Attr = ]
DEU19_10 -> %UserProfile%\My Documents\DEU19_10 -> [Folder | Created Date = 4/23/2008 12:26:41 PM | Attr = ]
EA Games -> %UserProfile%\My Documents\EA Games -> [Folder | Created Date = 4/14/2008 4:54:30 PM | Attr = ]
EBR01_01 -> %UserProfile%\My Documents\EBR01_01 -> [Folder | Created Date = 4/23/2008 12:26:48 PM | Attr = ]
EBR01_02 -> %UserProfile%\My Documents\EBR01_02 -> [Folder | Created Date = 4/23/2008 12:26:56 PM | Attr = ]
EBR01_03 -> %UserProfile%\My Documents\EBR01_03 -> [Folder | Created Date = 4/23/2008 12:27:02 PM | Attr = ]
EBR01_04 -> %UserProfile%\My Documents\EBR01_04 -> [Folder | Created Date = 4/23/2008 12:27:09 PM | Attr = ]
EBR01_05 -> %UserProfile%\My Documents\EBR01_05 -> [Folder | Created Date = 4/23/2008 12:27:16 PM | Attr = ]
EBR01_06 -> %UserProfile%\My Documents\EBR01_06 -> [Folder | Created Date = 4/23/2008 12:27:22 PM | Attr = ]
EBR01_07 -> %UserProfile%\My Documents\EBR01_07 -> [Folder | Created Date = 4/23/2008 12:27:28 PM | Attr = ]
EBR01_08 -> %UserProfile%\My Documents\EBR01_08 -> [Folder | Created Date = 4/23/2008 12:27:35 PM | Attr = ]
EBR01_09 -> %UserProfile%\My Documents\EBR01_09 -> [Folder | Created Date = 4/23/2008 12:27:41 PM | Attr = ]
EBR01_10 -> %UserProfile%\My Documents\EBR01_10 -> [Folder | Created Date = 4/23/2008 12:27:48 PM | Attr = ]
EBR01_11 -> %UserProfile%\My Documents\EBR01_11 -> [Folder | Created Date = 4/23/2008 12:27:54 PM | Attr = ]
EBR02_01 -> %UserProfile%\My Documents\EBR02_01 -> [Folder | Created Date = 4/23/2008 12:28:01 PM | Attr = ]
EBR02_02 -> %UserProfile%\My Documents\EBR02_02 -> [Folder | Created Date = 4/23/2008 12:28:11 PM | Attr = ]
EBR02_03 -> %UserProfile%\My Documents\EBR02_03 -> [Folder | Created Date = 4/23/2008 12:28:18 PM | Attr = ]
EBR02_04 -> %UserProfile%\My Documents\EBR02_04 -> [Folder | Created Date = 4/23/2008 12:28:29 PM | Attr = ]
EBR02_05 -> %UserProfile%\My Documents\EBR02_05 -> [Folder | Created Date = 4/23/2008 12:28:36 PM | Attr = ]
EBR02_06 -> %UserProfile%\My Documents\EBR02_06 -> [Folder | Created Date = 4/23/2008 12:28:42 PM | Attr = ]
EBR02_07 -> %UserProfile%\My Documents\EBR02_07 -> [Folder | Created Date = 4/23/2008 12:28:49 PM | Attr = ]
EBR02_08 -> %UserProfile%\My Documents\EBR02_08 -> [Folder | Created Date = 4/23/2008 12:28:55 PM | Attr = ]
EBR02_09 -> %UserProfile%\My Documents\EBR02_09 -> [Folder | Created Date = 4/23/2008 12:29:02 PM | Attr = ]
EBR02_10 -> %UserProfile%\My Documents\EBR02_10 -> [Folder | Created Date = 4/23/2008 12:29:07 PM | Attr = ]
EBR02_11 -> %UserProfile%\My Documents\EBR02_11 -> [Folder | Created Date = 4/23/2008 12:29:14 PM | Attr = ]
EBR03_01 -> %UserProfile%\My Documents\EBR03_01 -> [Folder | Created Date = 4/23/2008 12:29:20 PM | Attr = ]
EBR03_02 -> %UserProfile%\My Documents\EBR03_02 -> [Folder | Created Date = 4/23/2008 12:29:25 PM | Attr = ]
EBR03_03 -> %UserProfile%\My Documents\EBR03_03 -> [Folder | Created Date = 4/23/2008 12:29:31 PM | Attr = ]
EBR03_04 -> %UserProfile%\My Documents\EBR03_04 -> [Folder | Created Date = 4/23/2008 12:29:38 PM | Attr = ]
EBR03_05 -> %UserProfile%\My Documents\EBR03_05 -> [Folder | Created Date = 4/23/2008 12:29:43 PM | Attr = ]
EBR03_06 -> %UserProfile%\My Documents\EBR03_06 -> [Folder | Created Date = 4/23/2008 12:29:50 PM | Attr = ]
EBR03_07 -> %UserProfile%\My Documents\EBR03_07 -> [Folder | Created Date = 4/23/2008 12:29:56 PM | Attr = ]
EBR03_08 -> %UserProfile%\My Documents\EBR03_08 -> [Folder | Created Date = 4/23/2008 12:30:03 PM | Attr = ]
EBR03_09 -> %UserProfile%\My Documents\EBR03_09 -> [Folder | Created Date = 4/23/2008 12:30:11 PM | Attr = ]
EBR03_10 -> %UserProfile%\My Documents\EBR03_10 -> [Folder | Created Date = 4/23/2008 12:30:17 PM | Attr = ]
EBR03_11 -> %UserProfile%\My Documents\EBR03_11 -> [Folder | Created Date = 4/23/2008 12:30:23 PM | Attr = ]
EBR04_01 -> %UserProfile%\My Documents\EBR04_01 -> [Folder | Created Date = 4/23/2008 12:30:30 PM | Attr = ]
EBR04_02 -> %UserProfile%\My Documents\EBR04_02 -> [Folder | Created Date = 4/23/2008 12:30:36 PM | Attr = ]
EBR04_03 -> %UserProfile%\My Documents\EBR04_03 -> [Folder | Created Date = 4/23/2008 12:30:41 PM | Attr = ]
EBR04_04 -> %UserProfile%\My Documents\EBR04_04 -> [Folder | Created Date = 4/23/2008 12:30:47 PM | Attr = ]
EBR04_05 -> %UserProfile%\My Documents\EBR04_05 -> [Folder | Created Date = 4/23/2008 12:30:53 PM | Attr = ]
EBR04_06 -> %UserProfile%\My Documents\EBR04_06 -> [Folder | Created Date = 4/23/2008 12:30:59 PM | Attr = ]
EBR04_07 -> %UserProfile%\My Documents\EBR04_07 -> [Folder | Created Date = 4/23/2008 12:31:06 PM | Attr = ]
EBR04_08 -> %UserProfile%\My Documents\EBR04_08 -> [Folder | Created Date = 4/23/2008 12:31:12 PM | Attr = ]
EBR04_09 -> %UserProfile%\My Documents\EBR04_09 -> [Folder | Created Date = 4/23/2008 12:31:17 PM | Attr = ]
EBR04_10 -> %UserProfile%\My Documents\EBR04_10 -> [Folder | Created Date = 4/23/2008 12:31:23 PM | Attr = ]
EBR04_11 -> %UserProfile%\My Documents\EBR04_11 -> [Folder | Created Date = 4/23/2008 12:31:29 PM | Attr = ]
EBR05_01 -> %UserProfile%\My Documents\EBR05_01 -> [Folder | Created Date = 4/23/2008 12:31:36 PM | Attr = ]
EBR05_02 -> %UserProfile%\My Documents\EBR05_02 -> [Folder | Created Date = 4/23/2008 12:31:41 PM | Attr = ]
EBR05_03 -> %UserProfile%\My Documents\EBR05_03 -> [Folder | Created Date = 4/23/2008 12:31:48 PM | Attr = ]
EBR05_04 -> %UserProfile%\My Documents\EBR05_04 -> [Folder | Created Date = 4/23/2008 12:31:54 PM | Attr = ]
EBR05_05 -> %UserProfile%\My Documents\EBR05_05 -> [Folder | Created Date = 4/23/2008 12:32:02 PM | Attr = ]
EBR05_06 -> %UserProfile%\My Documents\EBR05_06 -> [Folder | Created Date = 4/23/2008 12:32:09 PM | Attr = ]
EBR05_07 -> %UserProfile%\My Documents\EBR05_07 -> [Folder | Created Date = 4/23/2008 12:32:22 PM | Attr = ]