Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Help With Trojan Horse Patched_C.LZI and others! [Solved]


  • This topic is locked This topic is locked

#1
jfstrat

jfstrat

    New Member

  • Member
  • Pip
  • 7 posts
Good evening,

Like other users, I also have the Trojan Horse Patched_C.LZI virus and numerous other viruses. Please help!! I posted on another forum almost two weeks ago when this first appeared, but the experts have never responded with help, and I believe the infection has gotten much worse.

I've attempted removal using both the AVG Free 8.5 program and Symantec Endpoint Protection. Although, I don't think Symantec loaded at all, since this virus seems to have stopped the Windows BFE service.

This is what AVG keeps telling me for the virus filename:

Trojan Horse Patched_C.LZI C:\Windows\System32\services.exe

Symantec Endpoint keeps displaying a detection results popup window that states it has quarantined numerous filenames with Trojan.Gen, Trojan.Gen.2, Trojan.ZeroAccess,B, and Trojan, ZeroAccess.C. I close the popup window, but it immediately pops up again and fills with the list.

I downloaded and ran the free version of STOPzilla AVM 2013. It stated that the computer has over 700 threats and has detected and quarantined:

"Trojan.Win32.Generic!BT" and "Rootkit.Win32,Slrefef.gen!b" in numerous files.

Vista also keeps displaying, "Host Process For Windows Services Has Stopped Working."

This is driving me crazy, so any help is MUCH appreciated! Thanks for your time.

Regards,
jfstrat

OTL logfile created on: 8/14/2012 8:37:20 PM - Run 3
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\Sheila\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.99 Gb Total Physical Memory | 3.60 Gb Available Physical Memory | 60.06% Memory free
12.09 Gb Paging File | 9.94 Gb Available in Paging File | 82.21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 582.50 Gb Total Space | 371.95 Gb Free Space | 63.85% Space Free | Partition Type: NTFS
Drive D: | 13.67 Gb Total Space | 1.93 Gb Free Space | 14.08% Space Free | Partition Type: NTFS

Computer Name: HP | User Name: Sheila | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/12 10:47:10 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Sheila\Downloads\OTL.exe
PRC - [2012/08/07 08:28:52 | 000,067,448 | R--- | M] (iS3, Inc.) -- C:\Program Files (x86)\STOPzilla!\SZServer.exe
PRC - [2012/08/07 08:28:44 | 000,194,424 | R--- | M] (iS3, Inc.) -- C:\Program Files (x86)\STOPzilla!\STOPzilla.exe
PRC - [2012/07/18 10:45:55 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/07/10 04:16:05 | 000,935,008 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012/07/10 04:16:04 | 001,107,552 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
PRC - [2011/10/30 19:23:58 | 000,198,576 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\SavUI.exe
PRC - [2011/10/30 19:23:56 | 000,137,224 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe
PRC - [2011/08/29 17:06:36 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) -- C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\2pbarsvc.exe
PRC - [2011/08/29 17:06:36 | 000,022,048 | ---- | M] (MindSpark) -- C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\2pmedint.exe
PRC - [2010/10/29 17:12:22 | 001,652,736 | R--- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files (x86)\AWS\WeatherBug\Weather.exe
PRC - [2010/01/15 08:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/11/04 19:20:14 | 000,597,792 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
PRC - [2009/10/24 04:18:54 | 000,360,224 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
PRC - [2009/09/01 18:21:10 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG8\avgwdsvc.exe
PRC - [2009/07/03 19:15:12 | 000,496,896 | ---- | M] (D-Link Corp.) -- C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe
PRC - [2009/04/10 02:26:02 | 001,328,424 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
PRC - [2009/04/10 02:22:06 | 000,185,640 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009/03/19 13:54:52 | 001,148,200 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2008/12/04 15:00:26 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008/12/04 15:00:20 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2008/11/20 13:47:28 | 000,062,768 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
PRC - [2008/06/26 21:09:36 | 000,167,936 | ---- | M] () -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe


========== Modules (No Company Name) ==========

MOD - [2012/07/18 10:45:55 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/07/10 04:16:05 | 000,132,704 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012/07/10 04:16:04 | 001,107,552 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/04/20 12:22:34 | 000,372,736 | ---- | M] () -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanDll.dll
MOD - [2009/04/11 02:28:22 | 000,223,232 | ---- | M] () -- \\?\globalroot\systemroot\syswow64\mswsock.dll
MOD - [2009/04/11 02:28:22 | 000,223,232 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dll
MOD - [2009/04/10 02:22:04 | 000,906,536 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2006/12/10 23:51:08 | 000,077,824 | R--- | M] () -- C:\Program Files (x86)\HP\Digital Imaging\bin\crm\xmltok.dll
MOD - [2006/12/10 23:51:08 | 000,065,536 | R--- | M] () -- C:\Program Files (x86)\HP\Digital Imaging\bin\crm\xmlparse.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009/12/03 20:27:24 | 000,028,672 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)
SRV - [2012/08/14 17:35:24 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/07 08:28:52 | 000,067,448 | R--- | M] (iS3, Inc.) [Auto | Running] -- C:\Program Files (x86)\STOPzilla!\SZServer.exe -- (szserver)
SRV - [2012/07/18 10:45:55 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/10 04:16:05 | 000,935,008 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe -- (vToolbarUpdater11.2.0)
SRV - [2012/06/14 11:20:22 | 000,109,064 | ---- | M] (Wajam) [On_Demand | Stopped] -- C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe -- (WajamUpdater)
SRV - [2011/10/30 19:24:00 | 002,594,816 | ---- | M] (Symantec Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe -- (SmcService)
SRV - [2011/10/30 19:24:00 | 000,324,016 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\snac64.exe -- (SNAC)
SRV - [2011/10/30 19:23:56 | 000,137,224 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe -- (SepMasterService)
SRV - [2011/08/29 17:06:36 | 000,042,504 | ---- | M] (COMPANYVERS_NAME) [Auto | Running] -- C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\2pbarsvc.exe -- (CouponAlert_2pService)
SRV - [2010/03/18 15:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/10/24 04:18:54 | 000,360,224 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2009/09/01 18:21:10 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG8\avgwdsvc.exe -- (avg8wd)
SRV - [2009/03/30 00:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/12/08 22:51:08 | 000,242,424 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2008/12/04 15:00:26 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2008/06/26 21:09:36 | 000,167,936 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe -- (WlanWpsSvc)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/08/02 12:07:41 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2012/08/02 12:07:31 | 000,118,768 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\SysPlant.sys -- (SysPlant)
DRV:64bit: - [2012/02/29 09:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/10/30 19:24:02 | 000,931,448 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\Drivers\SEP\0C0103E8\009D.105\x64\SYMEFA64.SYS -- (SymEFA)
DRV:64bit: - [2011/10/30 19:24:02 | 000,678,008 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\Drivers\SEP\0C0103E8\009D.105\x64\SRTSP64.SYS -- (SRTSP)
DRV:64bit: - [2011/10/30 19:24:02 | 000,451,192 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\SEP\0C0103E8\009D.105\x64\SYMDS64.SYS -- (SymDS)
DRV:64bit: - [2011/10/30 19:24:02 | 000,433,272 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\SEP\0C0103E8\009D.105\x64\SYMTDIV.SYS -- (SYMTDIV)
DRV:64bit: - [2011/10/30 19:24:02 | 000,171,128 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\SEP\0C0103E8\009D.105\x64\Ironx64.SYS -- (SymIRON)
DRV:64bit: - [2011/10/30 19:24:02 | 000,062,672 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\Teefer.sys -- (Teefer2)
DRV:64bit: - [2011/10/30 19:24:02 | 000,039,032 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\SEP\0C0103E8\009D.105\x64\SRTSPX64.SYS -- (SRTSPX)
DRV:64bit: - [2011/05/10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/11/25 06:59:16 | 000,628,840 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010/01/26 17:52:22 | 001,212,416 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009/09/30 20:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009/09/01 18:21:21 | 000,033,416 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\Drivers\avgmfx64.sys -- (AvgMfx64)
DRV:64bit: - [2009/09/01 18:21:17 | 000,427,016 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgldx64.sys -- (AvgLdx64)
DRV:64bit: - [2009/09/01 18:17:09 | 000,133,640 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\avgtdia.sys -- (AvgTdiA)
DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/02/26 07:46:34 | 010,276,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/01/20 10:49:48 | 000,195,584 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008/12/04 08:48:52 | 000,407,064 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iastor.sys -- (iaStor)
DRV:64bit: - [2008/01/20 22:47:25 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\serscan.sys -- (StillCam)
DRV:64bit: - [2007/04/23 15:15:48 | 000,031,016 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\rtlprot.sys -- (RtlProt)
DRV - [2012/08/12 12:21:02 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012/08/12 12:21:02 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/08/02 12:11:36 | 002,068,600 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120814.002\ex64.sys -- (NAVEX15)
DRV - [2012/08/02 12:11:36 | 000,120,440 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120814.002\eng64.sys -- (NAVENG)
DRV - [2012/07/28 04:38:40 | 000,509,088 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120813.002\IDSviA64.sys -- (IDSVia64)
DRV - [2012/07/11 00:48:32 | 001,161,376 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\BASHDefs\20120803.011\BHDrvx64.sys -- (BHDrvx64)
DRV - [2011/10/30 19:24:00 | 000,029,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\SyDvCtrl64.sys -- (SyDvCtrl)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cndt
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cndt
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{9090374E-E74F-4310-B227-600F3700693C}: "URL" = http://search.live.c...ms}&FORM=HPDTDF
IE:64bit: - HKLM\..\SearchScopes\{A956D909-6947-427E-BA1B-A310E8C656A6}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\URLSearchHook: {37153479-1976-43c3-a1ee-557513977b64} - SOFTWARE\Classes\CLSID\{37153479-1976-43c3-a1ee-557513977b64}\InprocServer32 File not found
IE - HKLM\..\URLSearchHook: {e917fc61-7f80-4f1f-a882-cdffffbe4c8d} - C:\Program Files (x86)\D-Link Toolbar\dlinktb.dll (AOL LLC.)
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{09971cee-01b8-42bc-9d91-456b1faad6be}: "URL" = http://search.mywebs...r={searchTerms}
IE - HKLM\..\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}: "URL" = http://slirsredirect...hromesbox-en-us
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKLM\..\SearchScopes\{9090374E-E74F-4310-B227-600F3700693C}: "URL" = http://search.live.c...ms}&FORM=HPDTDF
IE - HKLM\..\SearchScopes\{A956D909-6947-427E-BA1B-A310E8C656A6}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search...p={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylo...0000018e7cd0ac0
IE - HKCU\..\URLSearchHook: *{e917fc61-7f80-4f1f-a882-cdffffbe4c8d} - No CLSID value found
IE - HKCU\..\URLSearchHook: {37153479-1976-43c3-a1ee-557513977b64} - SOFTWARE\Classes\CLSID\{37153479-1976-43c3-a1ee-557513977b64}\InprocServer32 File not found
IE - HKCU\..\URLSearchHook: {7b9f8c21-46ec-4c0b-8683-e755ef84577a} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{09971cee-01b8-42bc-9d91-456b1faad6be}: "URL" = http://search.mywebs...r={searchTerms}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylo...0000018e7cd0ac0
IE - HKCU\..\SearchScopes\{132B7CD9-9108-4E1A-AACB-39079449AA62}: "URL" = http://search.condui...&ctid=CT2559647
IE - HKCU\..\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}: "URL" = http://slirsredirect...hromesbox-en-us
IE - HKCU\..\SearchScopes\{5D120573-F430-44A6-AB62-A1C0810B309D}: "URL" = http://www.google.co...1I7ADFA_enUS345
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\..\SearchScopes\{9090374E-E74F-4310-B227-600F3700693C}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.c...r=&d=2011-12-06 02:59:50&v=9.0.0.18&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AOL Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Coupons.com Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.aol.co...romesbox-en-us"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://search.coupons.com/"
FF - prefs.js..extensions.enabledItems: {23C17F9A-C4AF-4701-9657-D384E3EE8958}:1.0.0.11-PROD
FF - prefs.js..extensions.enabledItems: {926a10d2-4ce7-4331-b96f-ca4e22590fac}:5.45.3.3629
FF - prefs.js..keyword.URL: "http://search.condui...rchSource=2&q="
FF - prefs.js..network.proxy.ftp: ":0"
FF - prefs.js..network.proxy.gopher: ":0"
FF - prefs.js..network.proxy.http: ":0"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: ":0"
FF - prefs.js..network.proxy.ssl: ":0"


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@CouponAlert_2p.com/Plugin: C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\NP2pStub.dll (MindSpark)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Sheila\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Sheila\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.2: C:\Users\Sheila\AppData\Local\Yahoo!\BrowserPlus\2.9.2\Plugins\npybrowserplus_2.9.2.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]_2p.com: C:\Program Files (x86)\CouponAlert_2p\bar\1.bin [2011/10/16 19:37:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012/07/10 04:16:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2012/01/21 15:22:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2012/01/21 15:22:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}: C:\Program Files (x86)\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi [2012/01/26 14:18:46 | 000,185,164 | ---- | M] ()
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\IPSFFPlgn\ [2012/08/14 20:27:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/18 10:45:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/03/10 08:49:00 | 000,000,000 | ---D | M]

[2010/01/05 16:52:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sheila\AppData\Roaming\mozilla\Extensions
[2012/08/14 19:32:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sheila\AppData\Roaming\mozilla\Firefox\Profiles\jnd2v57a.default\extensions
[2012/02/26 17:50:27 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Sheila\AppData\Roaming\mozilla\Firefox\Profiles\jnd2v57a.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/07/23 17:32:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Sheila\AppData\Roaming\mozilla\Firefox\Profiles\jnd2v57a.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/03/03 09:19:23 | 000,000,000 | ---D | M] (Cox Toolbar) -- C:\Users\Sheila\AppData\Roaming\mozilla\Firefox\Profiles\jnd2v57a.default\extensions\{23C17F9A-C4AF-4701-9657-D384E3EE8958}
[2012/07/18 10:46:13 | 000,000,000 | ---D | M] (CompTool0234 Community Toolbar) -- C:\Users\Sheila\AppData\Roaming\mozilla\Firefox\Profiles\jnd2v57a.default\extensions\{37153479-1976-43c3-a1ee-557513977b64}
[2012/05/18 09:59:12 | 000,000,000 | ---D | M] ("D-Link Toolbar") -- C:\Users\Sheila\AppData\Roaming\mozilla\Firefox\Profiles\jnd2v57a.default\extensions\{926a10d2-4ce7-4331-b96f-ca4e22590fac}
[2012/05/25 16:53:23 | 000,002,269 | ---- | M] () -- C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\jnd2v57a.default\searchplugins\aol-search.xml
[2011/12/14 15:30:08 | 000,000,925 | ---- | M] () -- C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\jnd2v57a.default\searchplugins\conduit.xml
[2012/03/05 10:17:52 | 000,002,292 | ---- | M] () -- C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\jnd2v57a.default\searchplugins\inbox-search.xml
[2012/08/14 20:34:14 | 000,002,030 | ---- | M] () -- C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\jnd2v57a.default\searchplugins\search-here.xml
[2012/03/25 20:28:33 | 000,001,673 | ---- | M] () -- C:\Users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\jnd2v57a.default\searchplugins\web-search.xml
[2012/03/23 08:45:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/10/16 19:37:33 | 000,000,000 | ---D | M] (CouponAlert) -- C:\PROGRAM FILES (X86)\COUPONALERT_2P\BAR\1.BIN
[2012/08/14 20:27:32 | 000,000,000 | ---D | M] (Symantec Intrusion Prevention) -- C:\PROGRAMDATA\SYMANTEC\SYMANTEC ENDPOINT PROTECTION\12.1.1000.157.105\DATA\IPSFFPLGN
[2012/08/03 07:47:44 | 000,021,674 | ---- | M] () (No name found) -- C:\USERS\SHEILA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JND2V57A.DEFAULT\EXTENSIONS\[email protected]
[2012/07/18 10:45:55 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/12/27 11:03:09 | 000,466,944 | ---- | M] (Catalina Marketing Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll
[2012/02/22 19:58:26 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2012/03/13 19:20:16 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/22 19:58:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/07/10 04:16:04 | 000,003,765 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/19 13:13:05 | 000,002,361 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/06/27 13:36:05 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/27 13:36:05 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.condui...&ctid=CT2559647
CHR - default_search_provider: suggest_url = http://search.conduit.com/
CHR - homepage: http://search.babylo...0000018e7cd0ac0
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Sheila\AppData\Local\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Sheila\AppData\Local\Google\Chrome\Application\18.0.1025.168\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Sheila\AppData\Local\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\NP2pStub.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: BrowserPlus (from Yahoo!) v2.9.2 (Enabled) = C:\Users\Sheila\AppData\Local\Yahoo!\BrowserPlus\2.9.2\Plugins\npybrowserplus_2.9.2.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: AT_JamesWhite = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkeidgmehkdjmpjodpjkepolokanalkm\3_0\
CHR - Extension: YouTube = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: Google Search = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: CompTool0234 = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghnpfkmgeiojiaheaiefkilmjinpoccb\2.3.3.3_0\
CHR - Extension: CompTool0234 = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghnpfkmgeiojiaheaiefkilmjinpoccb\2.3.4.2_0\
CHR - Extension: Gmail = C:\Users\Sheila\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Shopping Sidekick) - {11111111-1111-1111-1111-110011501158} - C:\Program Files (x86)\Shopping Sidekick\Shopping Sidekick.dll (215 Apps)
O2 - BHO: (Cox Toolbar) - {23C17F9A-C4AF-4701-9657-D384E3EE8958} - C:\Program Files (x86)\coxtoolbartb\CoxToolbarDx.dll ()
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Coupons.com Toolbar) - {37153479-1976-43c3-a1ee-557513977b64} - C:\Program Files (x86)\Coupons.com\prxtbCou0.dll File not found
O2 - BHO: (Toolbar BHO) - {3a421c8f-e238-4aeb-8874-b8b5f2cc4772} - C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\2pbar.dll (MindSpark)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Assistant BHO) - {60e91567-ef8a-4520-bce2-83aba5256799} - C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\2pSrcAs.dll (COMPANYVERS_NAME)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (Inbox Toolbar) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O2 - BHO: (D-Link Toolbar Loader) - {f01858c7-2a68-4d93-9e22-502eae3917c2} - C:\Program Files (x86)\D-Link Toolbar\dlinktb.dll (AOL LLC.)
O2 - BHO: (TBSB07898 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Coupons.com CouponBar\tbcore3.dll ()
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Cox Toolbar) - {23C17F9A-C4AF-4701-9657-D384E3EE8958} - C:\Program Files (x86)\coxtoolbartb\CoxToolbarDx.dll ()
O3 - HKLM\..\Toolbar: (Coupon Alert) - {3462c343-be19-4143-af70-cefb56f46fc6} - C:\Program Files (x86)\CouponAlert_2p\bar\1.bin\2pbar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (Coupons.com Toolbar) - {37153479-1976-43c3-a1ee-557513977b64} - C:\Program Files (x86)\Coupons.com\prxtbCou0.dll File not found
O3 - HKLM\..\Toolbar: (D-Link Toolbar) - {61874dfa-9adf-44e5-8e61-f3913707e7d7} - C:\Program Files (x86)\D-Link Toolbar\dlinktb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (Coupons.com CouponBar) - {8660E5B3-6C41-44DE-8503-98D99BBECD41} - C:\Program Files (x86)\Coupons.com CouponBar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Coupons.com Toolbar) - {37153479-1976-43C3-A1EE-557513977B64} - C:\Program Files (x86)\Coupons.com\prxtbCou0.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (D-Link Toolbar) - {61874DFA-9ADF-44E5-8E61-F3913707E7D7} - C:\Program Files (x86)\D-Link Toolbar\dlinktb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HP Remote Software] C:\Program Files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exe ()
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [WPCUMI] C:\Windows\SysNative\WpcUmi.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files (x86)\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [ROC_roc_dec12] C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe ()
O4 - HKLM..\Run: [TSMAgent] c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] c:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000014 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Windows\SysNative\wpclsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmi...xControl_32.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79A91D81-C7C3-454B-87DC-1059F57BDC1D}: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18:64bit: - Protocol\Handler\inbox - No CLSID value found
O18:64bit: - Protocol\Handler\linkscanner - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\syswow64\userinit.exe) - c:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\SEP: DllName - (C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll) - File not found
O24 - Desktop WallPaper: C:\Users\Sheila\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sheila\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/12 09:45:37 | 000,074,872 | ---- | C] (GFI Software) -- C:\Windows\SysNative\drivers\sbapifs.sys
[2012/08/12 09:45:37 | 000,045,936 | ---- | C] (GFI Software) -- C:\Windows\SysNative\SBBD.EXE
[2012/08/12 09:45:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\STOPzilla
[2012/08/12 09:45:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\STOPzilla!
[2012/08/12 09:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\STOPzilla!
[2012/08/07 08:29:12 | 000,023,416 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\SZIO5.dll
[2012/08/07 08:29:02 | 000,546,680 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\SZComp5.dll
[2012/08/07 08:28:56 | 000,497,528 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\SZBase5.dll
[2012/08/03 07:49:13 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Sheila\Desktop\dds.scr
[2012/08/02 22:36:36 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/08/02 21:21:58 | 004,722,680 | ---- | C] (Swearware) -- C:\Users\Sheila\Desktop\ComboFix.exe
[2012/08/02 21:16:20 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Sheila\Desktop\aswMBR.exe
[2012/08/02 21:09:19 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Local\Macromedia
[2012/08/02 12:12:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2012/08/02 12:08:26 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Local\Symantec
[2012/08/02 12:07:41 | 000,174,200 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2012/08/02 12:07:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2012/08/02 12:07:41 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2012/08/02 12:07:31 | 000,512,944 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\sysfer.dll
[2012/08/02 12:07:31 | 000,374,704 | ---- | C] (Symantec Corporation) -- C:\Windows\SysWow64\sysfer.dll
[2012/08/02 12:07:31 | 000,288,176 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\SymVPN.dll
[2012/08/02 12:07:31 | 000,118,768 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SysPlant.sys
[2012/08/02 12:07:31 | 000,081,840 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\FwsVpn.dll
[2012/08/02 12:07:31 | 000,058,288 | ---- | C] (Symantec Corporation) -- C:\Windows\SysWow64\snacnp.dll
[2012/08/02 12:07:31 | 000,058,288 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\snacnp.dll
[2012/08/02 12:07:31 | 000,042,632 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\WGX64.SYS
[2012/08/02 12:07:31 | 000,011,184 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\sysferThunk.dll
[2012/08/02 12:07:31 | 000,010,672 | ---- | C] (Symantec Corporation) -- C:\Windows\SysWow64\sysferThunk.dll
[2012/08/02 12:07:13 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1992_12.com.symantec
[2012/08/02 12:07:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64
[2012/08/02 12:07:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection
[2012/08/02 12:07:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Symantec
[2012/08/02 12:07:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\SEP
[2012/08/02 12:07:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\SEP\0C0103E8
[2012/08/02 12:07:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105
[2012/08/02 11:43:46 | 000,000,000 | ---D | C] -- C:\Users\Sheila\Desktop\CM-146546-SEP_64Bit_version_12.1.1000
[2012/08/02 11:43:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Symantec
[2012/07/31 10:50:43 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2012/07/19 13:13:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012/07/19 13:13:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2012/07/19 13:13:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BabylonToolbar
[2012/07/19 13:13:10 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Roaming\BabylonToolbar
[2012/07/19 13:12:53 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Roaming\Babylon
[2012/07/19 13:12:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/07/19 13:12:34 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
[2012/07/19 13:12:32 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Local\Wajam
[2012/07/19 13:12:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wajam
[2012/07/19 13:12:12 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Local\Shopping Sidekick
[2012/07/19 13:12:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Shopping Sidekick
[2012/07/17 08:36:16 | 000,231,288 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Win325.dll
[2012/07/17 08:36:16 | 000,029,048 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3XDat5.dll
[2012/07/17 08:36:14 | 000,391,032 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3UI5.dll
[2012/07/17 08:36:12 | 000,100,216 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Svc5.dll
[2012/07/17 08:36:06 | 000,132,984 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3HTUI5.dll
[2012/07/17 08:36:06 | 000,104,312 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Inet5.dll
[2012/07/17 08:36:04 | 000,456,568 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3DBA5.dll
[2012/07/17 08:36:04 | 000,067,448 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Hks5.dll
[2012/07/17 08:36:02 | 000,812,920 | R--- | C] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Base5.dll
[13704 C:\Users\Sheila\AppData\Local\Temp\*.tmp files -> C:\Users\Sheila\AppData\Local\Temp\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/14 21:05:48 | 000,270,704 | ---- | M] () -- C:\Windows\SysWow64\drivers\kgpfr2.cfg
[2012/08/14 21:02:10 | 000,039,288 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
[2012/08/14 20:58:05 | 000,000,424 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpfr2.cfg
[2012/08/14 20:54:00 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-635047954-3736312933-3277114742-1000UA.job
[2012/08/14 20:53:59 | 000,000,326 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012/08/14 20:35:15 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/14 20:33:32 | 000,703,342 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/08/14 20:33:32 | 000,604,502 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/08/14 20:33:32 | 000,104,202 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/08/14 20:32:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/14 20:29:28 | 000,001,765 | ---- | M] () -- C:\Users\Sheila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk
[2012/08/14 20:27:47 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/14 20:27:40 | 000,000,404 | ---- | M] () -- C:\Windows\tasks\FreeFileViewerUpdateChecker.job
[2012/08/14 20:27:02 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/14 20:27:02 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/14 20:26:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/14 19:33:32 | 000,002,083 | ---- | M] () -- C:\Users\Sheila\Desktop\Google Chrome.lnk
[2012/08/14 19:33:32 | 000,002,045 | ---- | M] () -- C:\Users\Sheila\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/08/13 21:53:59 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-635047954-3736312933-3277114742-1000Core.job
[2012/08/13 02:02:43 | 062,475,843 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm
[2012/08/12 09:13:36 | 000,005,324 | ---- | M] () -- C:\Users\Sheila\AppData\Local\d3d9caps.dat
[2012/08/07 08:29:12 | 000,023,416 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\SZIO5.dll
[2012/08/07 08:29:02 | 000,546,680 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\SZComp5.dll
[2012/08/07 08:28:56 | 000,497,528 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\SZBase5.dll
[2012/08/03 08:51:19 | 000,003,145 | ---- | M] () -- C:\Users\Sheila\Desktop\Attach.zip
[2012/08/03 08:00:13 | 000,302,592 | ---- | M] () -- C:\Users\Sheila\Desktop\gmer.exe
[2012/08/03 07:49:16 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Sheila\Desktop\dds.scr
[2012/08/02 21:22:00 | 004,722,680 | ---- | M] (Swearware) -- C:\Users\Sheila\Desktop\ComboFix.exe
[2012/08/02 21:18:12 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Sheila\Desktop\aswMBR.exe
[2012/08/02 12:09:11 | 003,080,104 | ---- | M] () -- C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\Cat.DB
[2012/08/02 12:07:41 | 000,174,200 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2012/08/02 12:07:41 | 000,007,530 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2012/08/02 12:07:41 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/08/02 12:07:31 | 000,512,944 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\sysfer.dll
[2012/08/02 12:07:31 | 000,374,704 | ---- | M] (Symantec Corporation) -- C:\Windows\SysWow64\sysfer.dll
[2012/08/02 12:07:31 | 000,288,176 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\SymVPN.dll
[2012/08/02 12:07:31 | 000,118,768 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SysPlant.sys
[2012/08/02 12:07:31 | 000,081,840 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\FwsVpn.dll
[2012/08/02 12:07:31 | 000,058,288 | ---- | M] (Symantec Corporation) -- C:\Windows\SysWow64\snacnp.dll
[2012/08/02 12:07:31 | 000,058,288 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\snacnp.dll
[2012/08/02 12:07:31 | 000,042,632 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\WGX64.SYS
[2012/08/02 12:07:31 | 000,011,184 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\sysferThunk.dll
[2012/08/02 12:07:31 | 000,010,672 | ---- | M] (Symantec Corporation) -- C:\Windows\SysWow64\sysferThunk.dll
[2012/08/02 12:07:31 | 000,000,114 | ---- | M] () -- C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\isolate.ini
[2012/08/02 08:38:25 | 066,155,824 | ---- | M] () -- C:\Users\Sheila\Desktop\CM-146546-SEP_64Bit_version_12.1.1000.zip
[2012/07/30 15:04:45 | 000,002,651 | ---- | M] () -- C:\Users\Sheila\Desktop\Word.lnk
[2012/07/30 15:03:35 | 000,002,609 | ---- | M] () -- C:\Users\Sheila\Desktop\Excel.lnk
[2012/07/19 13:13:13 | 000,000,259 | ---- | M] () -- C:\user.js
[2012/07/17 08:36:16 | 000,231,288 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Win325.dll
[2012/07/17 08:36:16 | 000,029,048 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3XDat5.dll
[2012/07/17 08:36:14 | 000,391,032 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3UI5.dll
[2012/07/17 08:36:12 | 000,100,216 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Svc5.dll
[2012/07/17 08:36:06 | 000,132,984 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3HTUI5.dll
[2012/07/17 08:36:06 | 000,104,312 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Inet5.dll
[2012/07/17 08:36:04 | 000,456,568 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3DBA5.dll
[2012/07/17 08:36:04 | 000,067,448 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Hks5.dll
[2012/07/17 08:36:02 | 000,812,920 | R--- | M] (iS3, Inc.) -- C:\Windows\SysWow64\IS3Base5.dll

========== Files Created - No Company Name ==========

[2012/08/14 20:27:30 | 000,000,424 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpfr2.cfg
[2012/08/14 20:27:28 | 000,039,288 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
[2012/08/14 20:27:13 | 000,232,960 | ---- | C] () -- C:\Windows\Installer\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\U\[email protected]
[2012/08/13 18:51:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:51:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:50:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:50:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:49:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:49:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:48:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:48:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:48:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:47:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:47:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:46:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:46:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:46:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:45:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:44:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:44:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:44:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:43:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:43:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:42:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:42:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:41:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:41:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:41:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:40:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:40:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:39:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:39:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:39:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:38:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:38:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:37:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:37:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:36:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:36:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:36:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:35:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:35:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:35:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:34:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:34:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:33:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:33:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:32:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:32:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:31:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:31:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:31:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:30:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:30:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:29:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:29:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:28:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:28:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:28:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:27:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:27:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:26:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:26:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:26:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:25:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:25:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:24:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:24:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:24:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:23:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:23:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:22:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:22:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:21:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:21:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:20:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:20:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:20:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:19:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:19:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:18:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:18:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:17:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:17:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:17:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:16:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:16:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:16:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:15:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:15:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:14:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:14:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:13:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:13:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:13:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:12:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:12:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:12:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:11:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:10:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:10:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:09:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:09:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:08:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:08:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:07:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:07:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:07:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:06:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:06:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:05:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:05:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:05:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:04:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:04:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:03:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:03:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:03:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:02:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:02:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:01:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:01:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:01:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:00:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 18:00:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:59:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:59:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:59:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:58:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:57:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:57:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:57:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:56:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:55:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:55:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:55:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:54:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:54:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:53:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:53:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:52:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:52:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:52:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:51:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:51:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:51:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:50:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:50:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:49:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:49:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:48:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:48:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:47:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:47:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:46:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:46:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:46:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:45:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:45:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:44:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:44:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:44:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:43:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:43:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:42:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:42:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:41:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:41:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:41:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:40:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:40:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:40:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:39:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:39:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:39:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:38:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:38:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:38:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:38:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:37:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:37:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:37:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:36:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:36:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:36:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:35:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:35:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:35:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:35:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:34:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:34:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:34:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:34:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:33:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:33:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:33:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:33:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:32:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:32:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:32:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:31:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:31:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:31:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:31:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:30:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:30:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:30:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:30:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:30:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:29:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:29:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:29:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:29:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:28:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:28:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:28:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:28:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:27:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:27:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:27:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:27:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:26:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:26:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:25:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:25:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:25:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:24:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:24:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:23:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:23:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:22:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:22:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:22:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:21:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:21:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:20:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:20:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:20:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:19:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:19:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:19:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:18:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:18:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:17:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:17:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:16:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:16:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:16:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:15:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:15:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:15:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:14:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:14:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:13:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:13:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:13:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:12:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:12:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:11:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:11:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:10:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:10:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:10:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:09:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:09:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:08:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:08:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:08:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:07:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:07:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:07:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:06:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:06:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:05:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:05:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:04:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:04:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:04:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:03:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:03:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:02:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:02:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:01:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:01:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:01:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:00:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 17:00:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:59:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:59:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:59:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:58:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:57:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:57:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:57:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:56:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:56:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:55:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:55:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:54:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:54:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:53:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:53:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:53:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:52:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:52:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:51:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:51:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:50:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:50:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:49:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:49:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:49:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:48:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:48:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:47:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:47:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:47:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:46:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:46:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:45:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:45:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:44:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:44:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:44:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:43:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:43:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:42:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:42:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:42:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:41:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:41:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:40:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:40:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:40:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:39:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:39:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:38:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:38:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:38:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:37:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:36:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:36:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:36:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:35:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:35:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:34:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:34:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:33:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:33:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:33:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:32:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:32:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:32:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:31:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\dwha4[email protected]
[2012/08/13 16:31:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:30:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:30:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:29:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:29:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:29:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:28:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:28:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:27:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:27:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:27:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:26:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:26:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:25:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:25:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:25:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:24:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:24:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:23:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:23:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:22:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:22:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:22:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:21:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:21:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:21:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:20:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:20:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:19:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:19:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:18:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:18:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:18:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:17:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:17:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:16:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:16:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:15:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:15:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:15:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:14:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:14:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:13:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:13:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:13:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:12:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:12:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:11:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:11:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:11:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:10:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:09:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:09:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:09:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:08:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:07:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:07:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:06:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:06:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:06:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:05:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:05:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:04:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:04:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:04:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:03:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:03:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:02:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:02:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:02:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:01:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:01:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:00:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 16:00:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:59:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:59:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:59:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:58:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:58:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:57:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:57:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:57:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:56:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:56:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:55:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:55:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:54:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:54:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:53:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:53:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:53:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:52:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:52:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:51:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:51:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:51:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:50:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:50:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:49:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:49:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:48:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:48:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:48:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:47:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:47:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:46:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:46:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:45:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:45:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:45:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:44:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:44:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:44:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:43:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:43:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:42:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:42:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:42:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:41:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:41:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:40:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:40:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:39:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:39:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:38:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:38:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:37:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:37:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:36:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:36:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:36:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:35:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:35:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:34:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:34:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:34:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:33:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:33:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:32:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:32:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:32:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:31:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:31:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:30:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:30:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:29:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:29:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:29:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:28:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:28:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:27:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:27:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:27:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:26:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:26:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:26:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:25:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:25:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:24:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:24:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:23:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:23:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:23:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:22:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:22:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:21:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:21:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:21:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:20:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:20:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:19:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:19:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:18:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:18:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:18:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:17:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:17:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:16:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:16:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:16:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:15:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:15:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:15:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:14:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:14:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:13:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:13:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:12:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:11:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:11:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:11:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:10:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:10:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:10:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:09:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:09:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:08:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:08:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:08:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:07:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:07:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:06:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:06:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:05:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:05:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:04:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:04:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:04:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:03:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:03:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:02:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:02:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:01:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:01:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:01:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:00:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 15:00:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:59:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:59:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:59:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:58:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:57:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:57:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:56:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:56:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:56:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:55:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:55:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:55:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:54:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:54:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:53:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:53:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:53:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:52:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:52:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:51:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:51:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:50:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:50:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:50:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:49:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:49:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:48:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:48:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:48:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:47:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:47:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:46:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:46:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:46:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:45:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:45:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:44:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:44:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:44:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:43:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:43:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:43:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:42:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:42:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:41:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:41:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:40:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:40:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:39:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:39:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:39:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:38:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:38:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:37:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:37:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:37:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:36:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:36:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:35:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:35:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:34:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:34:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:34:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:33:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:33:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:33:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:32:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:32:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:31:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:31:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:30:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:30:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:30:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:29:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:29:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:28:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:28:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:27:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:27:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:27:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:26:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:26:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:25:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:25:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:25:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:24:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:24:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:23:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:23:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:23:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:22:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:22:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:21:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:21:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:20:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:20:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:20:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:19:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:19:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:18:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:18:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:18:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:17:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:17:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:16:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:16:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:15:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:15:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:14:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:14:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:14:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:13:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:13:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:12:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:12:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:12:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:11:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:11:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:10:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:10:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:10:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:09:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:09:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:08:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:08:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:07:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:07:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:07:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:06:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:06:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:05:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:05:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:05:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:04:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:04:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:03:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:03:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:03:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:02:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:02:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:01:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:01:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:00:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:00:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 14:00:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:59:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:59:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:59:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:58:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:57:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:57:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:56:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:56:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:56:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:55:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:55:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:54:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:54:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:53:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:52:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:52:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:52:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:51:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:51:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:50:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:49:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:49:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:48:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:48:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:48:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:47:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:47:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:47:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:46:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:46:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:45:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:45:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:44:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:44:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:43:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:43:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:43:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:42:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:42:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:41:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:41:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:41:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:40:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:40:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:39:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:39:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:39:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:39:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:38:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:38:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:38:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:38:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:37:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:37:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:37:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:37:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:36:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:36:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:36:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:36:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:35:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:35:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:35:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:35:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:34:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:34:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:34:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:34:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:33:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:33:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:33:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:33:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:32:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:32:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:32:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:32:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:31:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:31:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:31:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:31:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:30:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:30:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:30:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:30:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:29:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:29:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:29:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:29:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:28:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:28:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:28:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:28:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:27:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:27:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:27:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:27:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:26:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:26:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:26:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:26:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:25:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:25:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:25:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:25:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:24:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:24:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:24:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:24:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:23:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:23:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:23:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:23:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:23:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:22:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:22:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:22:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:22:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:21:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:21:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:21:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:21:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:20:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:20:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:20:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:20:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:19:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:19:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:19:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:19:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:19:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:18:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:18:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:18:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:18:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:17:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:17:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:17:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:17:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:17:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:16:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:16:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:16:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:15:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\dwh67[email protected]
[2012/08/13 13:15:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:15:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:15:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:14:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:14:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:14:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:14:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:14:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:13:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:13:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:13:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:13:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:12:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:12:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:12:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:12:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:11:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:11:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:11:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:10:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:10:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:10:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:10:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:10:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:09:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:09:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:09:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:08:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:08:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:08:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:08:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:08:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:07:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:07:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:07:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:07:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:06:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:06:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:06:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:06:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:06:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:05:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:05:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:05:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:04:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:04:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:04:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:04:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:03:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:03:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:03:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:03:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:02:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:02:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:02:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:02:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:02:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:01:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:01:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:01:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:01:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:00:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:00:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 13:00:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:59:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:59:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:59:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:59:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:59:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:58:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:58:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:58:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/13 12:57:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
[2012/08/12 09:53:44 | 000,265,224 | ---- | C] () -- C:\Windows\SysWow64\drivers\kgpfr2.cfg
[2012/08/03 08:51:18 | 000,003,145 | ---- | C] () -- C:\Users\Sheila\Desktop\Attach.zip
[2012/08/02 12:07:43 | 003,080,104 | ---- | C] () -- C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\Cat.DB
[2012/08/02 12:07:41 | 000,007,530 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2012/08/02 12:07:41 | 000,000,855 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/08/02 12:07:31 | 000,000,114 | ---- | C] () -- C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\isolate.ini
[2012/08/02 11:41:16 | 066,155,824 | ---- | C] () -- C:\Users\Sheila\Desktop\CM-146546-SEP_64Bit_version_12.1.1000.zip
[2012/08/02 11:40:40 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/31 10:43:33 | 000,000,673 | ---- | C] () -- C:\Windows\Installer\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\L\[email protected]
[2012/07/19 13:13:12 | 000,000,259 | ---- | C] () -- C:\user.js
[2012/01/21 15:17:16 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012/01/12 09:09:45 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\@
[2012/01/12 09:09:45 | 000,002,048 | -HS- | C] () -- C:\Users\Sheila\AppData\Local\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\@
[2011/07/31 18:16:41 | 000,000,129 | ---- | C] () -- C:\Users\Sheila\jagex_runescape_preferences2.dat
[2011/07/31 18:15:31 | 000,000,035 | ---- | C] () -- C:\Users\Sheila\jagex_runescape_preferences.dat
[2009/09/04 15:10:42 | 000,000,632 | RHS- | C] () -- C:\Users\Sheila\ntuser.pol
[2009/09/01 18:46:45 | 000,005,324 | ---- | C] () -- C:\Users\Sheila\AppData\Local\d3d9caps.dat
[2009/09/01 18:31:43 | 000,016,384 | ---- | C] () -- C:\Users\Sheila\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2012/07/19 13:12:53 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Babylon
[2012/07/19 13:13:11 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\BabylonToolbar
[2009/09/19 10:59:50 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Canon
[2011/12/27 11:03:09 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Catalina Marketing Corp
[2012/02/15 08:26:46 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\FreeFileViewer
[2012/02/26 17:51:12 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Garmin
[2012/02/01 19:25:56 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\iFitUSB.A325EF93A9FDC16120FBA0CC8A28360B0E189979.1
[2011/12/04 23:22:20 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Image Zone Express
[2009/09/01 17:27:18 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\PictureMover
[2009/10/02 12:07:53 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Printer Info Cache
[2012/01/24 15:53:01 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Visan
[2011/08/01 14:56:23 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\W Photo Studio
[2009/12/09 14:29:05 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\W Photo Studio Viewer
[2009/12/09 14:29:53 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\Walgreens
[2012/02/14 10:29:23 | 000,000,000 | ---D | M] -- C:\Users\Sheila\AppData\Roaming\WeatherBug
[2012/08/14 20:27:40 | 000,000,404 | ---- | M] () -- C:\Windows\Tasks\FreeFileViewerUpdateChecker.job
[2012/08/14 20:25:19 | 000,032,598 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
  • 0

Advertisements


#2
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hello jfstrat and welcome to my office here at G2G! :)

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:
  • Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
  • Absence of symptoms does not always mean the computer is clean
  • Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
  • Please DO NOT run any scans or fix on your own without my direction.
  • Please read all of my response through at least once before attempting to follow the procedures described.
  • If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
  • Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
  • You must reply within 3 days or your topic will be closed
Step 1

You have more than one antivirus programs on your PC.

Symantec and AVG

Please leave only one antivirus protection on your system and remove all other.

Anti-Virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash.

If you choose to install more than one Anti-Virus program on your computer, then only one of them should be active in memory at a time.

Step 2

NOTE: This fix is custom made for this system only and for current system state! Don't try to run it on another system!

Please close all running programs and Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    SRV - [2012/06/14 11:20:22 | 000,109,064 | ---- | M] (Wajam) [On_Demand | Stopped] -- C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe -- (WajamUpdater)
    O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
    IE - HKLM\..\SearchScopes\{09971cee-01b8-42bc-9d91-456b1faad6be}: "URL" = http://search.mywebs...r={searchTerms}
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylo...0000018e7cd0ac0
    IE - HKCU\..\SearchScopes\{09971cee-01b8-42bc-9d91-456b1faad6be}: "URL" = http://search.mywebs...r={searchTerms}
    IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylo...0000018e7cd0ac0
    IE - HKCU\..\SearchScopes\{132B7CD9-9108-4E1A-AACB-39079449AA62}: "URL" = http://search.condui...&ctid=CT2559647
    CHR - default_search_provider: search_url = http://search.condui...&ctid=CT2559647
    CHR - default_search_provider: suggest_url = http://search.conduit.com/
    CHR - homepage: http://search.babylo...0000018e7cd0ac0
    O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
    O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
    [2012/07/19 13:12:34 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
    [2012/07/19 13:12:32 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Local\Wajam
    [2012/07/19 13:12:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wajam
    [2012/08/13 18:51:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:51:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:50:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:50:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:49:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:49:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:48:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:48:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:48:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:47:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:47:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:46:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:46:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:46:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:45:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:44:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:44:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:44:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:43:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:43:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:42:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:42:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:41:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:41:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:41:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:40:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:40:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:39:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:39:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:39:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:38:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:38:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:37:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:37:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:36:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:36:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:36:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:35:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:35:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:35:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:34:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:34:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:33:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:33:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:32:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:32:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:31:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:31:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:31:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:30:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:30:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:29:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:29:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:28:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:28:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:28:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:27:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:27:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:26:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:26:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:26:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:25:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\dwh30[email protected]
    [2012/08/13 18:25:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:24:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:24:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:24:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:23:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:23:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:22:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\dwh87[email protected]
    [2012/08/13 18:22:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:21:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:21:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:20:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:20:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:20:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:19:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:19:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:18:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:18:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:17:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:17:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:17:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:16:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:16:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:16:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:15:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:15:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:14:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:14:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:13:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:13:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:13:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:12:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:12:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:12:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:11:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:10:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:10:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:09:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:09:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:08:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:08:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:07:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:07:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:07:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:06:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:06:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:05:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:05:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:05:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:04:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:04:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:03:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:03:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:03:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:02:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:02:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:01:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:01:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:01:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:00:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 18:00:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:59:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:59:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:59:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:58:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:57:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:57:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:57:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:56:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:55:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:55:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:55:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:54:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:54:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:53:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:53:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:52:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:52:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:52:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:51:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:51:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:51:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:50:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:50:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:49:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:49:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:48:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:48:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:47:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:47:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:46:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:46:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:46:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:45:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:45:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:44:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:44:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:44:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:43:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:43:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:42:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:42:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:41:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:41:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:41:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:40:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:40:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:40:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:39:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:39:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:39:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:38:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:38:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:38:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:38:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:37:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:37:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:37:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:36:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:36:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:36:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:35:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:35:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:35:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:35:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:34:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:34:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:34:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:34:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:33:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:33:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:33:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:33:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:32:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:32:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:32:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:31:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:31:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:31:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:31:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:30:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:30:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:30:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:30:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:30:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:29:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:29:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:29:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:29:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:28:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:28:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:28:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:28:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:27:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:27:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:27:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:27:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:26:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:26:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:25:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:25:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:25:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:24:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:24:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:23:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:23:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:22:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:22:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:22:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:21:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:21:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:20:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:20:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:20:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:19:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:19:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:19:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:18:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:18:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:17:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:17:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:16:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:16:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:16:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:15:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:15:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:15:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:14:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:14:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:13:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:13:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:13:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:12:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:12:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:11:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:11:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:10:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:10:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:10:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:09:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:09:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:08:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:08:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:08:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:07:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:07:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:07:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:06:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:06:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:05:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:05:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:04:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:04:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:04:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:03:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:03:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:02:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:02:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:01:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:01:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:01:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:00:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 17:00:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:59:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:59:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:59:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:58:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:57:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:57:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:57:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:56:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:56:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:55:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:55:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:54:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:54:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:53:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:53:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:53:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:52:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:52:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:51:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:51:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:50:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:50:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:49:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:49:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:49:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:48:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:48:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:47:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:47:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:47:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:46:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:46:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:45:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:45:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:44:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:44:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:44:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:43:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:43:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:42:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:42:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:42:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:41:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:41:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:40:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:40:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:40:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:39:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:39:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:38:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:38:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:38:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:37:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:36:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:36:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:36:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:35:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:35:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:34:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:34:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:33:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:33:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:33:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:32:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:32:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:32:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:31:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:31:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:30:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:30:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:29:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:29:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:29:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:28:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:28:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:27:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:27:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:27:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:26:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:26:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:25:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:25:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:25:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:24:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:24:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:23:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:23:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:22:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:22:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:22:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:21:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:21:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\dwh2b[email protected]
    [2012/08/13 16:21:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:20:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:20:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:19:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:19:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:18:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:18:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:18:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:17:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:17:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:16:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:16:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:15:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:15:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:15:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:14:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:14:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:13:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:13:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:13:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:12:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:12:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:11:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:11:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:11:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:10:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:09:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:09:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:09:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:08:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:07:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:07:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:06:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:06:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:06:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:05:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:05:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:04:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:04:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:04:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:03:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:03:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:02:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:02:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:02:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:01:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:01:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:00:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 16:00:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:59:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:59:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:59:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:58:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:58:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:57:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:57:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:57:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:56:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:56:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:55:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:55:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:54:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:54:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:53:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:53:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:53:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:52:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:52:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:51:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:51:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:51:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:50:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:50:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:49:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:49:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:48:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:48:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:48:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:47:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:47:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:46:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:46:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:45:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:45:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:45:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:44:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:44:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:44:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:43:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:43:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:42:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:42:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:42:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:41:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:41:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:40:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:40:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:39:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:39:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:38:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:38:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:37:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:37:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:36:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:36:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:36:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:35:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:35:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:34:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:34:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:34:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:33:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:33:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:32:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:32:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:32:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:31:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:31:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:30:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:30:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:29:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:29:39 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:29:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:28:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:28:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:27:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:27:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:27:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:26:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:26:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:26:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:25:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:25:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:24:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:24:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:23:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:23:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:23:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:22:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:22:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:21:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:21:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:21:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:20:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:20:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:19:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:19:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:18:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:18:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:18:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:17:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:17:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:16:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:16:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:16:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:15:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:15:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:15:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:14:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:14:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:13:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:13:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:12:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:11:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:11:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:11:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:10:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:10:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:10:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:09:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:09:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:08:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:08:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:08:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:07:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:07:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:06:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:06:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:05:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:05:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:04:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:04:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:04:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:03:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:03:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:02:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:02:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:01:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:01:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:01:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:00:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 15:00:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:59:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:59:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:59:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:58:07 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:57:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:57:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:56:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:56:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:56:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:55:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\dwhe0[email protected]
    [2012/08/13 14:55:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:55:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:54:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:54:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:53:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:53:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:53:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:52:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:52:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:51:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:51:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:50:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:50:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:50:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:49:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:49:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:48:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:48:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:48:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:47:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:47:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:46:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:46:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:46:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:45:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:45:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:44:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:44:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:44:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:43:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:43:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:43:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:42:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:42:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:41:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:41:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:40:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:40:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:39:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:39:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:39:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:38:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:38:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:37:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:37:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:37:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:36:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:36:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:35:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:35:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:34:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:34:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:34:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:33:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:33:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:33:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:32:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:32:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:31:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:31:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:30:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:30:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:30:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:29:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:29:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:28:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:28:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:27:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:27:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:27:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:26:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:26:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:25:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:25:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:25:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:24:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:24:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:23:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:23:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:23:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:22:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:22:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:21:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:21:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:20:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:20:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:20:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:19:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:19:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:18:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:18:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:18:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:17:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:17:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:16:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:16:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:15:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:15:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:14:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:14:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:14:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:13:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:13:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:12:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:12:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:12:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:11:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:11:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:10:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:10:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:10:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:09:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:09:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:08:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:08:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:07:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:07:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:07:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:06:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:06:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:05:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:05:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:05:06 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:04:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:04:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:03:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:03:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:03:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:02:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:02:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:01:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:01:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:00:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:00:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 14:00:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:59:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:59:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:59:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:58:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:58:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:57:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:57:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:56:53 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:56:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:56:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:55:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:55:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:54:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:54:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:53:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:52:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:52:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:52:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:51:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:51:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:50:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:49:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:49:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:48:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:48:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:48:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:47:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:47:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:47:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:46:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:46:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:45:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:45:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:44:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:44:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:43:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:43:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:43:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:42:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:42:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:41:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:41:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:41:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:40:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:40:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:39:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:39:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:39:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:39:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:38:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:38:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:38:20 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:38:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:37:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:37:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:37:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:37:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:36:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:36:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:36:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:36:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:35:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:35:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:35:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:35:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:34:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:34:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:34:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:34:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:33:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:33:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:33:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:33:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:32:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:32:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:32:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:32:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:31:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:31:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:31:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:31:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:30:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:30:28 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:30:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:30:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:29:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:29:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:29:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:29:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:28:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:28:32 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:28:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:28:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:27:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:27:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:27:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:27:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:26:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:26:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:26:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:26:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:25:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:25:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:25:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:25:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:24:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:24:42 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:24:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:24:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:23:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:23:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:23:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:23:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:23:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:22:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:22:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:22:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:22:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:21:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:21:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:21:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:21:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:20:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:20:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:20:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:20:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:19:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:19:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:19:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:19:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:19:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:18:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:18:34 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:18:21 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:18:08 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:17:55 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:17:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:17:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:17:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:17:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:16:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:16:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:16:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:15:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:15:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:15:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:15:12 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:14:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:14:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:14:35 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:14:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:14:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:13:46 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:13:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:13:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:13:02 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:12:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:12:27 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:12:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:12:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:11:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:11:37 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:11:23 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:10:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:10:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:10:24 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:10:15 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:10:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:09:48 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:09:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:09:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:08:57 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:08:52 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:08:33 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:08:17 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:08:04 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:07:51 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:07:36 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:07:25 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:07:14 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:06:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:06:44 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:06:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:06:09 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:06:01 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:05:47 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:05:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:05:11 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:04:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:04:40 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:04:26 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:04:16 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:03:56 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:03:41 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:03:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:03:13 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:02:54 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:02:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:02:29 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:02:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:02:05 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:01:45 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:01:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:01:10 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:01:00 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:00:50 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:00:30 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 13:00:22 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:59:59 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\dwhcb24[email protected]
    [2012/08/13 12:59:49 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:59:31 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:59:18 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:59:03 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:58:43 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:58:38 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:58:19 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/08/13 12:57:58 | 000,016,896 | ---- | C] () -- C:\Users\Sheila\AppData\Local\Temp\[email protected]
    [2012/07/19 13:13:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BabylonToolbar
    [2012/07/19 13:13:10 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Roaming\BabylonToolbar
    [2012/07/19 13:12:53 | 000,000,000 | ---D | C] -- C:\Users\Sheila\AppData\Roaming\Babylon
    [2012/07/19 13:12:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon

    :Files
    C:\Windows\Installer\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}
    C:\Users\Sheila\AppData\Local\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Post the fix log it produces in your next reply or you can find it in C:\_OTL\MovedFiles

Step 3

Download and Install Combofix

Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks

    Posted Image

    Posted Image
  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the combo fix log in your next reply

Step 4

Please don't forget to include these items in your reply:

  • OTL fix log
  • Combofix log
It would be helpful if you could post each log in separate post using "Add Reply" button
  • 0

#3
jfstrat

jfstrat

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Thanks for the reply and help...I'm starting the steps now and will post the results as requested. I removed AVG Free prior to running OTL. Below is the OTL log. jfstrat

========== OTL ==========
Service WajamUpdater stopped successfully!
Service WajamUpdater deleted successfully!
C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}\ deleted successfully.
C:\Program Files (x86)\Wajam\IE\priam_bho.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{09971cee-01b8-42bc-9d91-456b1faad6be}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09971cee-01b8-42bc-9d91-456b1faad6be}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{09971cee-01b8-42bc-9d91-456b1faad6be}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09971cee-01b8-42bc-9d91-456b1faad6be}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{132B7CD9-9108-4E1A-AACB-39079449AA62}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{132B7CD9-9108-4E1A-AACB-39079449AA62}\ not found.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to change the HomePage.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
C:\Users\Sheila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam folder moved successfully.
C:\Users\Sheila\AppData\Local\Wajam\Chrome folder moved successfully.
C:\Users\Sheila\AppData\Local\Wajam folder moved successfully.
C:\Program Files (x86)\Wajam\Updater folder moved successfully.
C:\Program Files (x86)\Wajam\IE folder moved successfully.
C:\Program Files (x86)\Wajam\Firefox folder moved successfully.
C:\Program Files (x86)\Wajam folder moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\dwh9f[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\dwh34b[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\dwh2[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
File C:\Users\Sheila\AppData\Local\Temp\[email protected] not found.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Users\Sheila\AppData\Local\Temp\[email protected] moved successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh folder moved successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17 folder moved successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Users\Sheila\AppData\Roaming\BabylonToolbar\Shared folder moved successfully.
C:\Users\Sheila\AppData\Roaming\BabylonToolbar\IE folder moved successfully.
C:\Users\Sheila\AppData\Roaming\BabylonToolbar\FF folder moved successfully.
C:\Users\Sheila\AppData\Roaming\BabylonToolbar\CR folder moved successfully.
C:\Users\Sheila\AppData\Roaming\BabylonToolbar folder moved successfully.
C:\Users\Sheila\AppData\Roaming\Babylon folder moved successfully.
C:\ProgramData\Babylon folder moved successfully.
========== FILES ==========
C:\Windows\Installer\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\U folder moved successfully.
C:\Windows\Installer\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\L folder moved successfully.
C:\Windows\Installer\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4} folder moved successfully.
C:\Users\Sheila\AppData\Local\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\U folder moved successfully.
C:\Users\Sheila\AppData\Local\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4}\L folder moved successfully.
C:\Users\Sheila\AppData\Local\{b35c8d88-2ec7-86e4-5d48-d663c0450ac4} folder moved successfully.

OTL by OldTimer - Version 3.2.57.0 log created on 08162012_175100

Edited by jfstrat, 16 August 2012 - 04:09 PM.

  • 0

#4
jfstrat

jfstrat

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Hello maliprog, I just wanted to give you a quick update. ComboFix has been running for about five hours right now and I'm not sure if it is hung up or not. It stopped for a bit at, "Completed Stage_48," then went to "Completed Stage_50" and now for the past hour or so has said, "System file is infected!! Attempting to restore C:\Windows\system32\Services.exe"

Not sure what to do next, but I'll leave it like this overnight and see if anything happens by morning.

Thanks and goodnight. jfstrat
  • 0

#5
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
That's too long. Please restart your system and after that try to locatre Combofix log at

C:\Combofix.txt

if you fail to find log there please see if you can find this log

C:\qoobox\ComboFix.txt

And post it here for me. If you can't find Combofix.txt log then please run Combofix again and hopefully it will finish scan and give us a log.
  • 0

#6
jfstrat

jfstrat

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Sometime overnight, the computer had rebooted itself, so when I logged in, ComboFix started again. But, it only ran for a few minutes then the log popped up. It looks like it did something right, I am getting no annoying popups now! :thumbsup:

Also, when I ran ComboFix last night, it warned me that AVG was still active, but I had uninstalled it before running both OTL and ComboFix. I see on the log that it mentions that AVG was "enabled/updated" but since I removed it, I had no way of disabling it.

Thanks, jfstrat

Here is the ComboFix log:


ComboFix 12-08-16.01 - Sheila 08/16/2012 18:20:32.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6133.4095 [GMT -4:00]
Running from: c:\users\Sheila\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Enabled/Updated* {0C939084-9E57-CBDB-EA61-0B0C7F62AF82}
SP: AVG Anti-Virus Free *Enabled/Updated* {B7F27160-B86D-C455-D0D1-307E04E5E53F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\CouponAlert_2p
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pauxstb.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pbar.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pbarsvc.exe
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pbrstub.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pdatact.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pdlghk.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pdyn.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pfeedmg.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2phighin.exe
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2phtml.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2phtmlmu.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2phttpct.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pidle.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pieovr.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pimpipe.exe
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pmedint.exe
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pmlbtn.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pmsg.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pPlugin.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pradio.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pregfft.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pregiet.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pscript.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pskin.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pskplay.exe
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2pSrcAs.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2ptpinst.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\2puabtn.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\CHROME.MANIFEST
c:\program files (x86)\CouponAlert_2p\bar\1.bin\chrome\2pffxtbr.jar
c:\program files (x86)\CouponAlert_2p\bar\1.bin\INSTALL.RDF
c:\program files (x86)\CouponAlert_2p\bar\1.bin\LOGO.BMP
c:\program files (x86)\CouponAlert_2p\bar\1.bin\NP2pStub.dll
c:\program files (x86)\CouponAlert_2p\bar\1.bin\T8FFTBPR.DLL
c:\program files (x86)\CouponAlert_2p\bar\1.bin\T8PATCH.DLL
c:\program files (x86)\CouponAlert_2p\bar\1.bin\T8RES.DLL
c:\program files (x86)\CouponAlert_2p\bar\1.bin\T8UNPAT.DLL
c:\program files (x86)\CouponAlert_2p\bar\IE9Mesg\COMMON.T8S
c:\program files (x86)\CouponAlert_2p\bar\Message\COMMON.T8S
c:\program files (x86)\CouponAlert_2p\bar\Settings\s_pid.dat
c:\program files (x86)\CouponAlert_2pEI
c:\programdata\HP
c:\programdata\HP\Digital Imaging\Data\Destination\aiopfl.dll
c:\programdata\HP\Digital Imaging\Data\Destination\profile.cue
c:\programdata\HP\Digital Imaging\Data\RedBox.ini
c:\programdata\HP\Digital Imaging\hp officejet 5600 series\1251842300\Data\1251842300.fxm
c:\programdata\HP\Digital Imaging\hp officejet 5600 series\1251842300\Data\1251842300.ini
c:\programdata\HP\Digital Imaging\hp officejet 5600 series\1251842300\Data\FaxSetup.txt
c:\programdata\HP\Digital Imaging\hp officejet 5600 series\1251842300\Data\ScanTo.ini
c:\programdata\HP\Digital Imaging\hp officejet 5600 series\1251842300\Q\Received.ini
c:\programdata\HP\Digital Imaging\hp officejet 5600 series\1251842300\Q\Sent.ini
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\ar\223ab1bc-e9cb-43d1-bb30-6fd5435bfd4c.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\cs\dfd9f489-bfab-4fb1-b26e-c2b2816ffa00.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\da\e7da55db-e615-48fc-a0bc-ac0c33a20b8e.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\de\29cdd5ae-c759-415a-b25c-e0772de0c017.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\el\2bd0cae2-8182-4cc9-b31b-94f2e913afad.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\en-US\9ae1fbdf-2d72-44c5-b34c-98d5f1be0775.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\en\0955adef-527d-4fc7-9a7d-e6e0722bef96.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\es\2b567cec-10a1-44c8-8d09-0162a5b6150e.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\fi\dfc3251b-df2b-462a-add4-1c0e7ddd7492.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\fr\73577267-5bca-46e7-81e2-30acee39cad8.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\he\8565b72a-11e1-4be9-acb8-3e61022b0ba9.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\hu\a3612c73-c1bc-4afb-bcc6-3a5eb2c3bdb9.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\it\9fde54a3-46aa-4f86-918d-80885d86da97.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\ja\410783b1-af07-43aa-a658-9ee1e99e03f5.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\ko\65fd0b59-6f77-4a08-bc16-213db4db19b2.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\nb\08faaffa-70dc-4641-8118-4a762a2e3f85.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\nl\a9caedf3-ac23-4fba-b3e0-e34292e1eb47.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\pl\aeadb101-c6a5-4fb3-b928-bb00d9c2cb39.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\pt\804c1d78-79ac-41f3-a1c9-a3476b23d07b.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\ru\64184ab4-1a10-49da-9777-f572006d85e4.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\sv\32a0980f-103a-47a8-ab55-ed41dcfc6678.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\tr\3b8b996e-11b2-4fb5-a084-649474b62ca7.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\zh-CN\9ae93648-da18-4321-b358-c9ebe68ba2d7.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\DeviceMetadataStore\zh-TW\20565c2b-d610-4aea-8a72-767b021b8cb3.devicemetadata-ms
c:\programdata\HP\HP Officejet Pro 8600\Help\1025\1025.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1025\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1025\synonyms-1025.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1026\1026.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1026\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1026\synonyms-1026.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1028\1028.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1028\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1028\synonyms-1028.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1029\1029.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1029\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1029\synonyms-1029.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1030\1030.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1030\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1030\synonyms-1030.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1031\1031.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1031\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1031\synonyms-1031.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1032\1032.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1032\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1032\synonyms-1032.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\1033.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\AnimationList.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\BCGCEDCJ.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\BCGFAIGI.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\CHDEFEFJ.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\CHDHHBAF.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\clean_adf.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\FAX_TROUBLESHOOTING.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\GeneratedFiles\bookmarks.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\GeneratedFiles\IndexerProgressBar.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\GET_STARTED.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\GET_SUPPORT.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\howdoi.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\HVMnemonicMap.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\insert_card.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\load_document_ADF.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\LOAD_MEDIA.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\LOAD_ORIG_AND_PAPER.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\load_paper_envelopes.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\load_paper_photo_paper.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\load_standard_paper.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\NETWORK.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\PAPERJAM.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\PRINTCART.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\PRODUCT_OVERVIEW.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\replace_ink_cartridge.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\s1033693.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\s1033718.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\s1035739.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\s1040488.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\s1042071.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\s637086.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\s644603.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\scan_original.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\SearchIndex\_cx.cfs
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\SearchIndex\deletable
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\SearchIndex\segments
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\SeeAlso.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\self_test_page.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\SOLVE_A_PROBLEM.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\solve_wireless_problems.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\synonyms-1033.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\TOC.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\TROUBLESHOOT_INSTALL.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\TROUBLESHOOTING.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\USE_COPY.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\USE_DIGITAL_SOLUTIONS.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\USE_FAX.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\USE_PRINT.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\USE_SCAN.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\USE_WEB.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v112467602.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122482694.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122483350.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122483514.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122536244.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122565626.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122595253.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122597243.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v122599363.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v1234567.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v137463065.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v139288638.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v141177552.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v143312686.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v143322588.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v143323151.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144316548.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144324282.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144324356.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144324430.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144324539.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144324648.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144354989.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144355181.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144355268.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144355353.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144355438.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144355523.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v144358023.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v146884370.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v157241862.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v157241928.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v164690349.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v168618997.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v170417813.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v171754308.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v171755293.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173331101.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173331289.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173331963.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173332307.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173332638.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173342433.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173344071.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173345740.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173346052.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173346146.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173346428.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173349703.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173355182.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173357170.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173357326.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173357512.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173357728.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173358034.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173358190.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173361357.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173371447.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173371551.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173371806.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173372097.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173372610.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173373014.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173373377.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173373741.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173373852.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173374615.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173375057.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173375745.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173375892.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173376040.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173412898.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173413009.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173413375.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v173856276.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174293568.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174312667.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174470482.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174474850.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174475551.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174703299.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174711800.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174711875.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174712306.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174713097.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174713527.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174713890.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174714546.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174717680.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174718448.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174843792.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v174845157.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v179198639.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v179251456.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v184829286.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v184829541.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v192098684.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185533.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185562.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185584.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185610.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185639.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185661.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185721.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v221185745.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v223605914.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v22640287.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v228315295.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v228328813.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v228328828.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v228328849.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v228328870.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v233814422.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v233814452.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v233817254.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v238970413.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v241807613.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v242817597.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v247001123.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v250369942.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v251420213.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253763615.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878349.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878360.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878370.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878382.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878440.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878488.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878499.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878610.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878632.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878637.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878752.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878783.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253878874.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253879088.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v253879208.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v262013085.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301267320.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301267424.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301267528.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301267840.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301275335.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301277813.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301277833.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278004.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278369.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278447.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278541.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278582.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278671.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278779.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278863.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278878.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301278984.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279110.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279125.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279292.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279441.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279564.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279579.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279765.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301279939.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301280093.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v301280261.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v305664498.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v305664513.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v307412636.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v307412869.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v307412880.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v307412898.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v307412906.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v307412922.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v308744259.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v308744718.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v308744824.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v308744866.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v308746535.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v308747518.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v309147733.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v309147791.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v309147834.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v309147904.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v309147964.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v324696604.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v337806143.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v337812467.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v337812540.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v337817450.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v337820129.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v344868931.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v345471345.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v345471486.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v348242611.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v351488915.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v351698801.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v351699076.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v369625152.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v370038827.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v372660279.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v372660293.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v372660345.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v372660394.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v372660415.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v372660442.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373156319.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373159974.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373159990.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373160030.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951265.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951296.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951395.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951499.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951508.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951566.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951622.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v373951652.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374154059.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374162100.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191257.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191269.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191305.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191320.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191398.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191462.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191473.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191485.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191532.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191544.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191571.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191598.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191608.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191628.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374191641.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v374625144.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v375454781.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v397329597.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v413608870.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v421840880.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v421840896.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v421840918.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v421840944.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v421840969.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v421840979.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v430853842.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945024.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945034.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945044.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945052.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945060.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945068.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945076.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945084.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945092.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945103.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v440945111.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194528.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194540.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194552.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194564.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194574.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194584.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194594.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194606.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v442194618.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v458201565.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v458201638.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v458201779.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v458202025.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v460158721.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v460158862.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v460159128.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v461711705.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v464573769.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v464573820.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v465122530.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v467246778.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v467246799.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v467246811.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v467247158.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v467247257.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v47148567.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v47148784.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v47148898.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v47149984.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v47151406.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v47154518.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477758494.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477934892.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477934927.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477934951.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477934961.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477934985.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935136.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935317.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935335.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935365.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935446.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935472.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935480.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935518.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935526.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935537.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935588.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935657.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935669.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935726.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935758.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935773.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935884.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935941.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477935968.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936049.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936607.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936618.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936631.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936654.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936675.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936730.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936843.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936879.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936890.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936913.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936940.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477936973.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477937013.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477937024.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477937034.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477937045.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477937065.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477937110.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477937118.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477951803.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477951857.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v477951867.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v479792579.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v481522424.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v483385461.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v65672082.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v70935656.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v70935668.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v70935710.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v73473547.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v800000007.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v80000005.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81350187.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81350663.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81356286.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81365814.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81366828.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81368656.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81376099.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81391632.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81460064.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81460141.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81460968.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81461069.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81461883.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81461935.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81497043.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81500649.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81500657.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81603226.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81810470.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81811499.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81829695.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81830425.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81837493.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81851297.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81856987.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v81860208.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v82089592.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v82093352.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v82101063.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v82102260.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v82102335.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v82102378.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v82252642.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v83092417.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v83092877.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v83471444.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v83471502.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v83471638.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v84130143.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85049955.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85049959.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85049963.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85336660.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85336678.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85336696.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85426938.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85426956.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85528954.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85533383.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85533603.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85533958.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85534353.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85771148.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85825310.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85825318.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85825527.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85828168.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85828184.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85828195.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v85994987.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v86713109.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v86750282.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v87428062.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v88490073.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v88723837.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v91435254.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v91961531.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v96240198.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v96240211.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v96240285.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v96240353.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v96635045.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\v96721679.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1033\x800000003.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1034\1034.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1034\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1034\synonyms-1034.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1035\1035.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1035\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1035\synonyms-1035.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1036\1036.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1036\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1036\synonyms-1036.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1037\1037.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1037\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1037\synonyms-1037.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1038\1038.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1038\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1038\synonyms-1038.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1040\1040.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1040\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1040\synonyms-1040.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1041\1041.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1041\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1041\synonyms-1041.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1042\1042.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1042\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1042\synonyms-1042.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1043\1043.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1043\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1043\synonyms-1043.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1044\1044.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1044\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1044\synonyms-1044.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1045\1045.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1045\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1045\synonyms-1045.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1046\1046.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1046\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1046\synonyms-1046.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1048\1048.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1048\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1048\synonyms-1048.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1049\1049.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1049\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1049\synonyms-1049.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1050\1050.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1050\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1050\synonyms-1050.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1051\1051.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1051\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1051\synonyms-1051.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1053\1053.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1053\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1053\synonyms-1053.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1054\1054.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1054\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1054\synonyms-1054.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1055\1055.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1055\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1055\synonyms-1055.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1057\1057.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1057\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1057\synonyms-1057.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1060\1060.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1060\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1060\synonyms-1060.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1061\1061.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1061\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1061\synonyms-1061.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1062\1062.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1062\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1062\synonyms-1062.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\1063\1063.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\1063\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\1063\synonyms-1063.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\2052\2052.cab
c:\programdata\HP\HP Officejet Pro 8600\Help\2052\elphome.html
c:\programdata\HP\HP Officejet Pro 8600\Help\2052\synonyms-2052.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\AC_RunActiveContent.js
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\cueFunctions.js
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\hubURL.js
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\bullet.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\checkbox.PNG
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\cmyk-color-bar.svg
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\collapsed.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\expanded.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\hyphen.PNG
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\icon_caution_color.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\icon_warning_color.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\projector_icon.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\registration-circle.svg
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\RightArrow.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\spacer.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\images\well.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\Accessory\masterStyle.css
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_insert_card.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_jams.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_load_ADF.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_load_envelopes.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_load_glass.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_load_small.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_load_standard.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_replace_cartridge.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_scan_card.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\flash\OJP8600-N911_transfer_scanner.swf
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Additional_Regulatory_Content.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\adf_green_tab_pull_midhi.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\adf_jam_lift_cover.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\adf_lift_cover.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\adf_load_paper.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Apps_Icon.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\arrowd.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\arrowl.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\arrowr.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\arrowu.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\back.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\button_cancel.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\button_power.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\caution.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\clean_scan_glass.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\color_lock_statement.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\copy.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\cp_overview_1.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\cp_overview_2.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\device_back_view.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\device_cart_open_ink_cover.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\device_front_view.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\dg_icon_dashboard_eco.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\dg_icon_wps.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\dg_keypad_fax_history.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\dg_keypad_sd_icon.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\dig_office.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\duplex_install.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\duplex_remove.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\envelope_load.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\eprint_icon.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faceplate_1.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\fax.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\fax_setup_dsl.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\fax_setup_dsl_ans_mach.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\fax_setup_dsl_pc_only.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_dedicated.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_DSL_simplified.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_phone_ans_mach.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_shared_ans_mach.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_shared_dial_modem.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_shared_line.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_shared_pc_phone.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\faxsetup_shared_pc_phone2.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\home.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\HP_ePrint.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\icon_checkmark.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\ink_cartridge_letters.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\install_ink_cart.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\install_pha.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\jam_rear_door.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_apps.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_auto_answer.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_copy.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_discover.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_fax.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_ink_cart_info.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_ink_cart_info2.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_network.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_photo.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_scan.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_setup.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_wired_network.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_cp_wireless_network.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\kar_eprint_icon.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\LASER_ColorLok_CMYK_WhiteBkgd.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\lift_latch_ph.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_ar_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_bg_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_cs_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_da_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_de_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_el_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_en_ap.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_en_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_es_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_et_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_fi_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_fr_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_he_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_hr_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_hu_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_id_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_it_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_ja_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_jp_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_ko_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_lt_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_lv_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_nl_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_no_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_pl_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_pt_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_ro_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_ru_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_sk_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_sl_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_sv_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_th_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_tr_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_zh_cn.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Limited_warranty_zh_tw.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\load_tray_media.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\minimum_margins.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\network_config_page1.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\network_config_page2.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\phone_list_ww_no_urls.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\power.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\pq_diag_report.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\print_borderless_icon.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\print_brochures_icon.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\print_docs.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\print_envelopes_icon.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\print_photos.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\print_specialty_icon.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\printer_status_report.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\printhead_remove.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\printing_supplies_area2.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_battery_directive_eu.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_battery_statement_nl_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_battery_statement_zh_tw.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_ce.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_ce_nh.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_emission_statement_de_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_energystar_logo_ww.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_fcc_statement_class_b_us.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_gs_statement_de_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_led_ind_state_en_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_notice_to_users_ko_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_power_cord_notice_jp_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_rohs_tbl_genric_zh_cn.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_tele_ind_canada_notc_ca.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_telecom_fcc_notice_part_68_us.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_telecom_notice_de_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_telecom_wirefax_state_au.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_vcci_class_b_notic_jp_ww.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_wireless_not_to_users_br.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_wireless_not_to_users_ca.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_wireless_not_zh_tw.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\reg_wireless_rad_freq_rad_us.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\scan.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\scan_load_paper.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\settings.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\splitter.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\tray_output_ext_pullout.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\tray_output_extension_pull_out.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\Tray1_pull_out.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\tray2_load_media.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\tray2_output_extension_pull_out.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\tray2_pull_out.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\versatile_printing.png
c:\programdata\HP\HP Officejet Pro 8600\Help\graphics\online\warranty_cartridge.gif
c:\programdata\HP\HP Officejet Pro 8600\Help\images\global_product_bg_blue.png
c:\programdata\HP\HP Officejet Pro 8600\Help\images\global_product_bg_blue_gtk.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\images\global_product_bg_blue_hd.jpg
c:\programdata\HP\HP Officejet Pro 8600\Help\images\global_product_bg_blue_wide.png
c:\programdata\HP\HP Officejet Pro 8600\Help\sysparm.xml
c:\programdata\HP\HP Officejet Pro 8600\Help\topicmap.xml
c:\programdata\HP\HP Officejet Pro 8600\HP Officejet Pro 8600 (USB)\XmlFileCache\CN1B11K33905KD\DevMgmt\DiscoveryTree.xml
c:\programdata\HP\HP Officejet Pro 8600\HP Officejet Pro 8600 (USB)\XmlFileCache\CN1B11K33905KD\Scan\ScanCaps.xml
c:\programdata\HP\HP Officejet Pro 8600\HP Officejet Pro 8600 (USB)\XmlFileCache\CN1B11K33905KD\WalkupScanToComp\WalkupScanToCompCaps
c:\programdata\HP\HP Officejet Pro 8600\HPCustPartic\CN1B11K33905KD\FW.ini
c:\programdata\HP\HP Officejet Pro 8600\HPCustPartic\CN1B11K33905KD\system.ini
c:\programdata\HP\HP Officejet Pro 8600\HPCustPartic\schedule.ini
c:\programdata\HP\HP Officejet Pro 8600\HPCustPartic\schedulekeeper.ini
c:\programdata\HP\HP Officejet Pro 8600\HPCustPartic\survey.ini
c:\programdata\HP\HP Officejet Pro 8600\HV_Preferences.ini
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1025\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1028\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1029\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1030\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1031\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1032\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1033\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1034\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1035\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1036\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1037\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1038\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1040\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1041\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1042\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1043\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1044\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1045\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1046\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1049\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1053\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\1055\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\Installer\Help\2052\HP_Setup_Help.chm
c:\programdata\HP\HP Officejet Pro 8600\NetworkDevices\CN1B11K33905KD.ini
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\Calibration\CalibrationManifest.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\DevMgmt\ConsumableConfigCap.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\DevMgmt\DiscoveryTree.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\DevMgmt\FaxConfigCap.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\DevMgmt\InternalPrintCap.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\DevMgmt\ProductConfigCap.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\ePrint\ePrintConfigCap.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\ePrint\ePrintManifest.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\IoMgmt\IoMgmtManifest.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\Scan\ScanCaps.xml
c:\programdata\HP\HP Officejet Pro 8600\XmlFileCache\CN1B11K33905KD\WalkupScanToComp\WalkupScanToCompCaps
c:\programdata\HP\Installer\Temp\DrvIns000.log
c:\programdata\HP\Installer\Temp\hpoAIO_CDB_Software.log
c:\programdata\HP\Installer\Temp\hpoMSI_AIO_CDB_ToolboxIni64.log
c:\programdata\HP\Installer\Temp\hpoMSI_AiOScan.log
c:\programdata\HP\Installer\Temp\hpoMSI_BufferChm.log
c:\programdata\HP\Installer\Temp\hpoMSI_CIOUserMode64.log
c:\programdata\HP\Installer\Temp\hpoMSI_Copy.log
c:\programdata\HP\Installer\Temp\hpoMSI_Destinations.log
c:\programdata\HP\Installer\Temp\hpoMSI_DeviceManagementQFolder.log
c:\programdata\HP\Installer\Temp\hpoMSI_DocProc.log
c:\programdata\HP\Installer\Temp\hpoMSI_eSupportQFolder.log
c:\programdata\HP\Installer\Temp\hpoMSI_Fax.log
c:\programdata\HP\Installer\Temp\hpoMSI_hpproductassistant.log
c:\programdata\HP\Installer\Temp\hpoMSI_ImageZoneExpress.log
c:\programdata\HP\Installer\Temp\hpoMSI_OCRQFolder.log
c:\programdata\HP\Installer\Temp\hpoMSI_Scan.log
c:\programdata\HP\Installer\Temp\hpoMSI_SolutionCenter.log
c:\programdata\HP\Installer\Temp\hpoMSI_Status.log
c:\programdata\HP\Installer\Temp\hpoMSI_Toolbox.log
c:\programdata\HP\Installer\Temp\hpoMSI_TrayApp.log
c:\programdata\HP\Installer\Temp\hpoMSI_WebReg.log
c:\programdata\HP\Installer\Temp\hpoUnloadSupport.log
c:\programdata\HP\Installer\Temp\hpz_MSI.oj5600_Help_install.log
c:\programdata\HP\Installer\Temp\hpz_MSI.oj5600_install.log
c:\programdata\HP\Installer\Temp\hpz_MSI.oj5600Trb_install.log
c:\programdata\HP\Installer\Temp\hpzarp000.log
c:\programdata\HP\Installer\Temp\hpzarp001.log
c:\programdata\HP\Installer\Temp\hpzarp002.log
c:\programdata\HP\Installer\Temp\hpzarp003.log
c:\programdata\HP\Installer\Temp\hpzcdl000.log
c:\programdata\HP\Installer\Temp\hpzcdl001.log
c:\programdata\HP\Installer\Temp\hpzcdl002.log
c:\programdata\HP\Installer\Temp\hpzcdl003.log
c:\programdata\HP\Installer\Temp\hpzchk000.log
c:\programdata\HP\Installer\Temp\hpzdui000.log
c:\programdata\HP\Installer\Temp\hpzgat000.log
c:\programdata\HP\Installer\Temp\HPZIDS000.log
c:\programdata\HP\Installer\Temp\hpzmsi000.log
c:\programdata\HP\Installer\Temp\hpzmsi001.log
c:\programdata\HP\Installer\Temp\hpzmsi002.log
c:\programdata\HP\Installer\Temp\hpzmsi003.log
c:\programdata\HP\Installer\Temp\hpzmsi004.log
c:\programdata\HP\Installer\Temp\hpzmsi005.log
c:\programdata\HP\Installer\Temp\hpzmsi006.log
c:\programdata\HP\Installer\Temp\hpzmsi007.log
c:\programdata\HP\Installer\Temp\hpzmsi008.log
c:\programdata\HP\Installer\Temp\hpzmsi009.log
c:\programdata\HP\Installer\Temp\hpzmsi010.log
c:\programdata\HP\Installer\Temp\hpzmsi011.log
c:\programdata\HP\Installer\Temp\hpzmsi012.log
c:\programdata\HP\Installer\Temp\hpzmsi013.log
c:\programdata\HP\Installer\Temp\hpzmsi014.log
c:\programdata\HP\Installer\Temp\hpznop000.log
c:\programdata\HP\Installer\Temp\hpznop001.log
c:\programdata\HP\Installer\Temp\hpzopt000.log
c:\programdata\HP\Installer\Temp\hpzpnp000.log
c:\programdata\HP\Installer\Temp\hpzpnp001.log
c:\programdata\HP\Installer\Temp\hpzpnp002.log
c:\programdata\HP\Installer\Temp\hpzprl000.log
c:\programdata\HP\Installer\Temp\hpzprl001.log
c:\programdata\HP\Installer\Temp\hpzprl002.log
c:\programdata\HP\Installer\Temp\hpzprl003.log
c:\programdata\HP\Installer\Temp\hpzprl004.log
c:\programdata\HP\Installer\Temp\hpzprl005.log
c:\programdata\HP\Installer\Temp\hpzprl006.log
c:\programdata\HP\Installer\Temp\hpzprl007.log
c:\programdata\HP\Installer\Temp\hpzprl008.log
c:\programdata\HP\Installer\Temp\hpzpsc000.log
c:\programdata\HP\Installer\Temp\hpzpsc001.log
c:\programdata\HP\Installer\Temp\hpzpsl000.log
c:\programdata\HP\Installer\Temp\hpzrcn000.log
c:\programdata\HP\Installer\Temp\hpzrcv000.log
c:\programdata\HP\Installer\Temp\hpzrcv001.log
c:\programdata\HP\Installer\Temp\hpzrcv002.log
c:\programdata\HP\Installer\Temp\hpzrcv003.log
c:\programdata\HP\Installer\Temp\hpzrei000.log
c:\programdata\HP\Installer\Temp\hpzset000.log
c:\programdata\HP\Installer\Temp\hpzset001.log
c:\programdata\HP\Installer\Temp\hpzset002.log
c:\programdata\HP\Installer\Temp\hpzset003.log
c:\programdata\HP\Installer\Temp\hpzset004.log
c:\programdata\HP\Installer\Temp\hpzset005.log
c:\programdata\HP\Installer\Temp\hpzset006.log
c:\programdata\HP\Installer\Temp\hpzshl000.log
c:\programdata\HP\Installer\Temp\hpzshl001.log
c:\programdata\HP\Installer\Temp\hpzstu000.log
c:\programdata\HP\Installer\Temp\hpzstu001.log
c:\programdata\HP\Installer\Temp\hpzstu002.log
c:\programdata\HP\Installer\Temp\hpzstu003.log
c:\programdata\HP\Installer\Temp\hpzsui000.log
c:\programdata\HP\Installer\Temp\hpzwiz000.log
c:\programdata\HP\Installer\Temp\hpzwrp000.log
c:\programdata\HP\Installer\Temp\hpzwrp001.log
c:\programdata\HP\Installer\Temp\hpzwup000.log
c:\programdata\HP\Installer\Temp\Setup0000.log
c:\programdata\HP\Installer\Temp\setup0001.log
c:\programdata\HP\ProductAssistant\data\hprbevst.cdx
c:\programdata\HP\ProductAssistant\data\hprbevst.dbf
c:\programdata\HP\ProductAssistant\data\hprbevst.dst
c:\programdata\HP\ProductAssistant\data\hprbevst.idx
c:\programdata\HP\ProductAssistant\data\hprbhist.dbf
c:\programdata\HP\ProductAssistant\data\hprbilst.cdx
c:\programdata\HP\ProductAssistant\data\hprbilst.dbf
c:\programdata\HP\ProductAssistant\data\hprbipkg.dbf
c:\programdata\HP\ProductAssistant\data\hprbplst.cdx
c:\programdata\HP\ProductAssistant\data\hprbplst.dbf
c:\programdata\HP\ProductAssistant\sdb\BITMAPS.DBF
c:\programdata\HP\ProductAssistant\sdb\CONTENT.DBF
c:\programdata\HP\ProductAssistant\sdb\DBINFO.DBF
c:\programdata\HP\ProductAssistant\sdb\EVENTS.DBF
c:\programdata\HP\ProductAssistant\sdb\SCRIPTLETS.DBF
c:\programdata\HP\ProductAssistant\sdb\SCRIPTS.DBF
c:\programdata\HP\ProductAssistant\sdb\SOLSETS.cdx
c:\programdata\HP\ProductAssistant\sdb\SOLSETS.DBF
c:\programdata\HP\ProductAssistant\sdb\STRINGS.DBF
c:\users\Dylan\AppData\Roaming\HP
c:\users\Dylan\AppData\Roaming\HP\CRMLogs\BrandAuthentication.htm
c:\users\Dylan\AppData\Roaming\HP\CRMLogs\SolutionCenter2.htm
c:\users\Dylan\AppData\Roaming\HP\ScLogs\SolutionCenter.htm
c:\users\McKenzie\AppData\Roaming\HP
c:\users\McKenzie\AppData\Roaming\HP\CRMLogs\BrandAuthentication.htm
c:\users\Sheila\AppData\Roaming\HP
c:\users\Sheila\AppData\Roaming\HP\CRMLogs\BrandAuthentication.htm
c:\users\Sheila\AppData\Roaming\HP\CRMLogs\SolutionCenter2.htm
c:\users\Sheila\AppData\Roaming\HP\Digital Imaging\Data\Destination\profile.cue
c:\users\Sheila\AppData\Roaming\HP\ScLogs\SolutionCenter.htm
c:\windows\assembly\GAC_32\Desktop.ini . . . . Failed to delete
c:\windows\assembly\GAC_64\Desktop.ini . . . . Failed to delete
.
c:\windows\system32\Services.exe . . . is infected!!
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_CouponAlert_2pService
.
.
((((((((((((((((((((((((( Files Created from 2012-07-17 to 2012-08-17 )))))))))))))))))))))))))))))))
.
.
2012-08-17 08:27 . 2012-08-17 08:27 -------- d-----w- c:\programdata\HP
2012-08-17 08:24 . 2012-08-17 08:24 -------- d-----w- c:\users\McKenzie\AppData\Local\temp
2012-08-17 08:24 . 2012-08-17 08:24 -------- d-----w- c:\users\Dylan\AppData\Local\temp
2012-08-17 08:24 . 2012-08-17 08:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-16 21:58 . 2012-01-12 13:28 74872 ----a-r- c:\windows\system32\drivers\sbapifs.sys
2012-08-16 21:51 . 2012-08-16 21:51 -------- d-----w- C:\_OTL
2012-08-12 13:45 . 2012-01-19 14:22 45936 ------w- c:\windows\system32\SBBD.EXE
2012-08-12 13:45 . 2012-08-12 13:45 -------- d-----w- c:\program files (x86)\STOPzilla!
2012-08-12 13:45 . 2012-08-17 12:13 -------- d-----w- c:\programdata\STOPzilla!
2012-08-07 12:29 . 2012-08-07 12:29 23416 ----a-r- c:\windows\SysWow64\SZIO5.dll
2012-08-07 12:29 . 2012-08-07 12:29 546680 ----a-r- c:\windows\SysWow64\SZComp5.dll
2012-08-07 12:28 . 2012-08-07 12:28 497528 ----a-r- c:\windows\SysWow64\SZBase5.dll
2012-08-03 01:09 . 2012-08-03 01:09 -------- d-----w- c:\users\Sheila\AppData\Local\Macromedia
2012-08-02 16:12 . 2012-08-02 16:12 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2012-08-02 16:08 . 2012-08-02 16:08 -------- d-----w- c:\users\Sheila\AppData\Local\Symantec
2012-08-02 15:43 . 2012-08-02 15:43 -------- d-----w- c:\programdata\Symantec
2012-08-02 15:40 . 2012-08-14 21:35 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-31 14:50 . 2012-07-31 14:50 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
2012-07-27 12:30 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BE2D1A3F-BAB6-4927-9E5A-7B941EA175B9}\mpengine.dll
2012-07-19 17:13 . 2012-07-19 17:13 -------- d-----w- c:\program files (x86)\7-Zip
2012-07-19 17:13 . 2012-07-19 17:13 259 ----a-w- C:\user.js
2012-07-19 17:13 . 2012-08-16 21:52 -------- d-----w- c:\program files (x86)\BabylonToolbar
2012-07-19 17:12 . 2012-07-19 17:12 -------- d-----w- c:\users\Sheila\AppData\Local\Shopping Sidekick
2012-07-19 17:12 . 2012-08-16 22:00 -------- d-----w- c:\program files (x86)\Shopping Sidekick
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-14 21:35 . 2011-05-22 11:52 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-17 12:36 . 2012-07-17 12:36 29048 ----a-r- c:\windows\SysWow64\IS3XDat5.dll
2012-07-17 12:36 . 2012-07-17 12:36 231288 ----a-r- c:\windows\SysWow64\IS3Win325.dll
2012-07-17 12:36 . 2012-07-17 12:36 391032 ----a-r- c:\windows\SysWow64\IS3UI5.dll
2012-07-17 12:36 . 2012-07-17 12:36 100216 ----a-r- c:\windows\SysWow64\IS3Svc5.dll
2012-07-17 12:36 . 2012-07-17 12:36 132984 ----a-r- c:\windows\SysWow64\IS3HTUI5.dll
2012-07-17 12:36 . 2012-07-17 12:36 104312 ----a-r- c:\windows\SysWow64\IS3Inet5.dll
2012-07-17 12:36 . 2012-07-17 12:36 67448 ----a-r- c:\windows\SysWow64\IS3Hks5.dll
2012-07-17 12:36 . 2012-07-17 12:36 456568 ----a-r- c:\windows\SysWow64\IS3DBA5.dll
2012-07-17 12:36 . 2012-07-17 12:36 812920 ----a-r- c:\windows\SysWow64\IS3Base5.dll
2012-07-11 07:02 . 2006-11-02 12:35 59701280 ----a-w- c:\windows\system32\mrt.exe
2012-06-13 13:58 . 2012-07-11 07:00 2769408 ----a-w- c:\windows\system32\win32k.sys
2012-06-08 17:59 . 2012-07-11 06:39 12899840 ----a-w- c:\windows\system32\shell32.dll
2012-06-05 16:47 . 2012-07-11 06:39 1401856 ----a-w- c:\windows\SysWow64\msxml6.dll
2012-06-05 16:47 . 2012-07-11 06:39 1248768 ----a-w- c:\windows\SysWow64\msxml3.dll
2012-06-05 16:22 . 2012-07-11 06:39 1797120 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 16:22 . 2012-07-11 06:39 1869824 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 15:29 . 2012-07-11 06:39 516480 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-06-02 22:19 . 2012-06-21 19:12 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-21 19:13 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-21 19:13 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-21 19:13 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-21 19:12 35864 ----a-w- c:\windows\SysWow64\wups.dll
2012-06-02 22:19 . 2012-06-21 19:12 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-21 19:12 577048 ----a-w- c:\windows\SysWow64\wuapi.dll
2012-06-02 22:15 . 2012-06-21 19:13 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-21 19:12 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 22:12 . 2012-06-21 19:12 88576 ----a-w- c:\windows\SysWow64\wudriver.dll
2012-06-02 19:19 . 2012-06-21 19:12 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:19 . 2012-06-21 19:12 171904 ----a-w- c:\windows\SysWow64\wuwebv.dll
2012-06-02 19:15 . 2012-06-21 19:12 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 19:12 . 2012-06-21 19:12 33792 ----a-w- c:\windows\SysWow64\wuapp.exe
2012-06-02 12:49 . 2012-07-11 07:00 17807360 ----a-w- c:\windows\system32\mshtml.dll
2012-06-02 12:17 . 2012-07-11 07:00 10924032 ----a-w- c:\windows\system32\ieframe.dll
2012-06-02 12:12 . 2012-07-11 07:00 2311680 ----a-w- c:\windows\system32\jscript9.dll
2012-06-02 12:05 . 2012-07-11 07:00 1346048 ----a-w- c:\windows\system32\urlmon.dll
2012-06-02 12:05 . 2012-07-11 07:00 1392128 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 12:04 . 2012-07-11 07:00 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-02 12:04 . 2012-07-11 07:00 237056 ----a-w- c:\windows\system32\url.dll
2012-06-02 12:03 . 2012-07-11 07:00 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-06-02 12:01 . 2012-07-11 07:00 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-02 12:00 . 2012-07-11 07:00 818688 ----a-w- c:\windows\system32\jscript.dll
2012-06-02 11:59 . 2012-07-11 07:00 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-06-02 11:57 . 2012-07-11 07:00 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-06-02 11:57 . 2012-07-11 07:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-06-02 11:54 . 2012-07-11 07:00 248320 ----a-w- c:\windows\system32\ieui.dll
2012-06-02 08:33 . 2012-07-11 07:00 1800192 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-06-02 08:25 . 2012-07-11 07:00 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2012-06-02 08:25 . 2012-07-11 07:00 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-06-02 08:20 . 2012-07-11 07:00 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-06-02 08:16 . 2012-07-11 07:00 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-06-02 00:22 . 2012-07-11 06:39 347136 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 00:22 . 2012-07-11 06:39 254464 ----a-w- c:\windows\system32\ncrypt.dll
2012-06-02 00:05 . 2012-07-11 06:39 77312 ----a-w- c:\windows\SysWow64\secur32.dll
2012-06-02 00:04 . 2012-07-11 06:39 278528 ----a-w- c:\windows\SysWow64\schannel.dll
2012-06-02 00:03 . 2012-07-11 06:39 204288 ----a-w- c:\windows\SysWow64\ncrypt.dll
2012-05-31 16:25 . 2009-10-05 00:03 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2009-04-11 . 934E0B7D77FF78C18D9F8891221B6DE3 . 384512 . . [6.0.6002.18005] .. c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.exe
[7] 2008-01-21 . DFAC660F0F139276CC9299812DE42719 . 384512 . . [6.0.6001.18000] .. c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.exe
[-] 2009-04-11 . BC81150939BD52DBC7A08C245F1FB229 . 384512 . . [6.0.6000.16386] .. c:\windows\system32\services.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{23C17F9A-C4AF-4701-9657-D384E3EE8958}]
2010-09-15 09:17 86696 ----a-w- c:\program files (x86)\coxtoolbartb\CoxToolbarDx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{23C17F9A-C4AF-4701-9657-D384E3EE8958}"= "c:\program files (x86)\coxtoolbartb\CoxToolbarDx.dll" [2010-09-15 86696]
"{8660E5B3-6C41-44DE-8503-98D99BBECD41}"= "c:\program files (x86)\Coupons.com CouponBar\tbcore3.dll" [2012-02-06 2664864]
.
[HKEY_CLASSES_ROOT\clsid\{23c17f9a-c4af-4701-9657-d384e3ee8958}]
.
[HKEY_CLASSES_ROOT\clsid\{8660e5b3-6c41-44de-8503-98d99bbecd41}]
[HKEY_CLASSES_ROOT\TBSB07898.TBSB07898.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB07898.TBSB07898]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]
"Weather"="c:\program files (x86)\AWS\WeatherBug\Weather.exe" [2010-10-29 1652736]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-15 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdatePDIRShortCut"="c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2009-02-02 210216]
"TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2009-04-10 1328424]
"CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2009-04-10 185640]
"DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2009-03-19 1148200]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2009-11-04 597792]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\users\Sheila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Monitor Ink Alerts - .lnk - c:\windows\system32\RunDll32.exe [2006-11-2 46592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2009-2-9 430080]
Wireless Connection Manager.lnk - c:\program files (x86)\D-Link\DWA-131 revA\wirelesscm.exe [2010-7-23 496896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-14 250056]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 21:35]
.
2012-08-17 c:\windows\Tasks\FreeFileViewerUpdateChecker.job
- c:\program files (x86)\FreeFileViewer\FFVCheckForUpdates.exe [2012-02-14 19:24]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-27 00:19]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-27 00:19]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-635047954-3736312933-3277114742-1000Core.job
- c:\users\Sheila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-31 11:42]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-635047954-3736312933-3277114742-1000UA.job
- c:\users\Sheila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-31 11:42]
.
2012-08-17 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-11-16 10:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Remote Software"="c:\program files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exe" [2009-02-06 172032]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-05 154648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-05 227352]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-05 202264]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-12-04 186904]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 182784]
"combofix"="c:\combofix\CF29045.3XE" [2008-01-21 363008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/?affID=113959&tt=190712_ctrl_2912_1&babsrc=HP_ss&mntrId=96feff1e0000000000000018e7cd0ac0
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\jnd2v57a.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-dlink-chromesbox-en-us
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://search.coupons.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=2&q=
FF - user.js: general.useragent.extra.brc - BRI/1
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extensions.BabylonToolbar_i.babTrack, affID=113959&tt=190712_ctrl_2912_1
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 96feff1e0000000000000018e7cd0ac0
FF - user.js: extensions.BabylonToolbar_i.hardId - 96feff1e0000000000000018e7cd0ac0
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15540
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1713:13
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{37153479-1976-43c3-a1ee-557513977b64} - c:\program files (x86)\Coupons.com\prxtbCou0.dll
BHO-{37153479-1976-43c3-a1ee-557513977b64} - c:\program files (x86)\Coupons.com\prxtbCou0.dll
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Toolbar-{37153479-1976-43c3-a1ee-557513977b64} - c:\program files (x86)\Coupons.com\prxtbCou0.dll
Wow6432Node-HKLM-Run-ROC_roc_dec12 - c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe
Notify-SEP - c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{37153479-1976-43C3-A1EE-557513977B64} - (no file)
HKLM-Run-SmartMenu - c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
HKLM-Run-(Default) - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe
AddRemove-Coupons.com Toolbar - c:\program files (x86)\Coupons.com\uninstall.exe
AddRemove-Wajam - c:\program files (x86)\Wajam\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\SepMasterService]
"ImagePath"="\"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe\" /s \"Symantec Endpoint Protection\" /m \"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\sms.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\SmcService]
"ImagePath"="\"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Symantec\Symantec Endpoint Protection\CurrentVersion]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe
c:\program files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2012-08-17 08:17:41 - machine was rebooted
ComboFix-quarantined-files.txt 2012-08-17 12:17
.
Pre-Run: 403,047,620,608 bytes free
Post-Run: 402,512,228,352 bytes free
.
- - End Of File - - 7D1266A349FCA423B923BD0799CF6F12
  • 0

#7
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
To remove AVG please download AVG Remover and run it in order to remove AVG. It will remove all leftovers from your system.


You are still infected. We need to find replacement for infected files.

Run OTL again

  • Double click on the icon to run it (If running Vista or Windows 7, right click on it and select "Run as an Administrator"). Make sure all other windows are closed and to let it run uninterrupted.
  • Press button named None Posted Image
  • Under the Custom Scan/Fixes box paste this in

    /md5start
    services.*
    /md5stop
    
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open OTL.txt. This file is also saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it here to me

  • 0

#8
jfstrat

jfstrat

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Ok, ran AVG Remover (it was quick, so I hope it worked) and OTL as requested. Here is the log:


OTL logfile created on: 8/17/2012 9:07:32 AM - Run 4
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\Sheila\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.99 Gb Total Physical Memory | 3.73 Gb Available Physical Memory | 62.26% Memory free
12.11 Gb Paging File | 10.08 Gb Available in Paging File | 83.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 582.50 Gb Total Space | 373.95 Gb Free Space | 64.20% Space Free | Partition Type: NTFS
Drive D: | 13.67 Gb Total Space | 1.93 Gb Free Space | 14.08% Space Free | Partition Type: NTFS

Computer Name: HP | User Name: Sheila | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< MD5 for: SERVICES >
[2006/09/18 17:37:24 | 000,017,244 | ---- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 -- C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6001.18000_none_60a39df1afb86c9f\services

< MD5 for: SERVICES.EXE >
[2008/01/20 22:50:34 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2009/04/11 03:10:50 | 000,384,512 | ---- | M] (Microsoft Corporation) MD5=934E0B7D77FF78C18D9F8891221B6DE3 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.exe
[2009/04/11 03:10:50 | 000,384,512 | ---- | M] (Microsoft Corporation) MD5=BC81150939BD52DBC7A08C245F1FB229 -- C:\Windows\SysNative\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\SysWOW64\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe
[2008/01/20 22:49:44 | 000,384,512 | ---- | M] (Microsoft Corporation) MD5=DFAC660F0F139276CC9299812DE42719 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2006/11/02 11:13:31 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C -- C:\Windows\SysWOW64\en-US\services.exe.mui
[2006/11/02 11:13:31 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C -- C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_67c6851b290a1ced\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=F514B57C09E143F1E14415A9E9ADD695 -- C:\Windows\SysNative\en-US\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=F514B57C09E143F1E14415A9E9ADD695 -- C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c3e5209ee1678e23\services.exe.mui

< MD5 for: SERVICES.LNK >
[2008/01/20 23:20:59 | 000,001,688 | ---- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2008/01/20 23:20:59 | 000,001,688 | ---- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOCHIADS.COM.SOL >
[2009/12/31 21:17:18 | 000,000,419 | ---- | M] () MD5=DD5CC3FB3CA201A3BECE6345CD7DC25B -- C:\Users\Sheila\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\TPH6ZTBT\mochiads.com\services.mochiads.com.sol
[2010/03/06 21:22:20 | 000,000,476 | ---- | M] () MD5=ED072C330BEFFCB69491D70DCE2A8C9D -- C:\Users\Dylan\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\WX53BQW6\mochiads.com\services.mochiads.com.sol

< MD5 for: SERVICES.MOF >
[2006/09/18 17:44:54 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\SysNative\wbem\services.mof
[2006/09/18 17:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\SysWOW64\wbem\services.mof
[2006/09/18 17:44:54 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.mof
[2006/09/18 17:44:54 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.mof
[2006/09/18 17:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.mof
[2006/09/18 17:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.mof

< MD5 for: SERVICES.MSC >
[2006/11/02 11:13:51 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\en-US\services.msc
[2006/09/18 17:29:41 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\services.msc
[2006/11/02 11:14:00 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\en-US\services.msc
[2006/09/18 17:29:40 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\services.msc
[2006/11/02 11:13:51 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_fe26f08ab7d12816\services.msc
[2006/09/18 17:29:41 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_2b827e27fe185619\services.msc
[2006/11/02 11:14:00 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a2085506ff73b6e0\services.msc
[2006/09/18 17:29:40 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_cf63e2a445bae4e3\services.msc

< MD5 for: SERVICES.PNG >
[2009/02/02 14:59:42 | 000,000,875 | ---- | M] () MD5=3382D191625A7528ED791FEDCCE3F212 -- C:\Program Files\PC-Doctor for Windows\Images\img16_16\services.png
[2009/02/02 14:59:44 | 000,002,244 | ---- | M] () MD5=8C5F2C34A5FB317B868565F9451BF74C -- C:\Program Files\PC-Doctor for Windows\Images\img32_32\services.png
[2009/02/02 14:59:44 | 000,006,479 | ---- | M] () MD5=AFCA60ED198BE9309943722FE8758392 -- C:\Program Files\PC-Doctor for Windows\Images\img64_64\services.png
[2009/02/02 14:59:44 | 000,004,193 | ---- | M] () MD5=E1C3A20056206C394E65B37CE1D43851 -- C:\Program Files\PC-Doctor for Windows\Images\img48_48\services.png
[2009/02/02 14:59:44 | 000,001,509 | ---- | M] () MD5=F4EC3ABEAE15FA9BB42D721E9D543F44 -- C:\Program Files\PC-Doctor for Windows\Images\img24_24\services.png

< End of report >
  • 0

#9
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::

Folder::

FCopy::
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.exe | c:\windows\system32\Services.exe


Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
  • 0

#10
jfstrat

jfstrat

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
maliprog, here is the ComboFix log. It ran much faster this time!


ComboFix 12-08-17.03 - Sheila 08/18/2012 9:59.2.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6133.3227 [GMT -4:00]
Running from: c:\users\Sheila\Desktop\ComboFix.exe
Command switches used :: c:\users\Sheila\Desktop\CFScript.txt
AV: STOPzilla! *Disabled/Updated* {17032AB1-6644-0721-EEB5-A39B8B646009}
SP: STOPzilla! *Disabled/Updated* {AC62CB55-407E-08AF-D405-98E9F0E32AB4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\HP
c:\programdata\HP\Digital Imaging\Data\RedBox.ini
c:\programdata\HP\HP Officejet Pro 8600\HPCustPartic\schedule.ini
c:\programdata\HP\HP Officejet Pro 8600\HPCustPartic\schedulekeeper.ini
c:\users\Sheila\AppData\Roaming\HP
c:\users\Sheila\AppData\Roaming\HP\CRMLogs\BrandAuthentication.htm
c:\users\Sheila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.exe --> c:\windows\system32\Services.exe
.
((((((((((((((((((((((((( Files Created from 2012-07-18 to 2012-08-18 )))))))))))))))))))))))))))))))
.
.
2012-08-18 14:21 . 2012-08-18 14:21 -------- d-----w- c:\users\McKenzie\AppData\Local\temp
2012-08-18 14:21 . 2012-08-18 14:21 -------- d-----w- c:\users\Dylan\AppData\Local\temp
2012-08-18 14:21 . 2012-08-18 14:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-16 21:58 . 2012-01-12 13:28 74872 ----a-r- c:\windows\system32\drivers\sbapifs.sys
2012-08-16 21:51 . 2012-08-16 21:51 -------- d-----w- C:\_OTL
2012-08-12 13:45 . 2012-01-19 14:22 45936 ------w- c:\windows\system32\SBBD.EXE
2012-08-12 13:45 . 2012-08-12 13:45 -------- d-----w- c:\program files (x86)\STOPzilla!
2012-08-12 13:45 . 2012-08-17 12:15 -------- d-----w- c:\programdata\STOPzilla!
2012-08-07 12:29 . 2012-08-07 12:29 23416 ----a-r- c:\windows\SysWow64\SZIO5.dll
2012-08-07 12:29 . 2012-08-07 12:29 546680 ----a-r- c:\windows\SysWow64\SZComp5.dll
2012-08-07 12:28 . 2012-08-07 12:28 497528 ----a-r- c:\windows\SysWow64\SZBase5.dll
2012-08-03 01:09 . 2012-08-03 01:09 -------- d-----w- c:\users\Sheila\AppData\Local\Macromedia
2012-08-02 16:12 . 2012-08-02 16:12 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2012-08-02 16:08 . 2012-08-02 16:08 -------- d-----w- c:\users\Sheila\AppData\Local\Symantec
2012-08-02 15:43 . 2012-08-02 15:43 -------- d-----w- c:\programdata\Symantec
2012-08-02 15:40 . 2012-08-14 21:35 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-31 14:50 . 2012-07-31 14:50 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
2012-07-27 12:30 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BE2D1A3F-BAB6-4927-9E5A-7B941EA175B9}\mpengine.dll
2012-07-19 17:13 . 2012-07-19 17:13 -------- d-----w- c:\program files (x86)\7-Zip
2012-07-19 17:13 . 2012-07-19 17:13 259 ----a-w- C:\user.js
2012-07-19 17:13 . 2012-08-16 21:52 -------- d-----w- c:\program files (x86)\BabylonToolbar
2012-07-19 17:12 . 2012-07-19 17:12 -------- d-----w- c:\users\Sheila\AppData\Local\Shopping Sidekick
2012-07-19 17:12 . 2012-08-16 22:00 -------- d-----w- c:\program files (x86)\Shopping Sidekick
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-14 21:35 . 2011-05-22 11:52 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-17 12:36 . 2012-07-17 12:36 29048 ----a-r- c:\windows\SysWow64\IS3XDat5.dll
2012-07-17 12:36 . 2012-07-17 12:36 231288 ----a-r- c:\windows\SysWow64\IS3Win325.dll
2012-07-17 12:36 . 2012-07-17 12:36 391032 ----a-r- c:\windows\SysWow64\IS3UI5.dll
2012-07-17 12:36 . 2012-07-17 12:36 100216 ----a-r- c:\windows\SysWow64\IS3Svc5.dll
2012-07-17 12:36 . 2012-07-17 12:36 132984 ----a-r- c:\windows\SysWow64\IS3HTUI5.dll
2012-07-17 12:36 . 2012-07-17 12:36 104312 ----a-r- c:\windows\SysWow64\IS3Inet5.dll
2012-07-17 12:36 . 2012-07-17 12:36 67448 ----a-r- c:\windows\SysWow64\IS3Hks5.dll
2012-07-17 12:36 . 2012-07-17 12:36 456568 ----a-r- c:\windows\SysWow64\IS3DBA5.dll
2012-07-17 12:36 . 2012-07-17 12:36 812920 ----a-r- c:\windows\SysWow64\IS3Base5.dll
2012-07-11 07:02 . 2006-11-02 12:35 59701280 ----a-w- c:\windows\system32\mrt.exe
2012-06-13 13:58 . 2012-07-11 07:00 2769408 ----a-w- c:\windows\system32\win32k.sys
2012-06-08 17:59 . 2012-07-11 06:39 12899840 ----a-w- c:\windows\system32\shell32.dll
2012-06-05 16:47 . 2012-07-11 06:39 1401856 ----a-w- c:\windows\SysWow64\msxml6.dll
2012-06-05 16:47 . 2012-07-11 06:39 1248768 ----a-w- c:\windows\SysWow64\msxml3.dll
2012-06-05 16:22 . 2012-07-11 06:39 1797120 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 16:22 . 2012-07-11 06:39 1869824 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 15:29 . 2012-07-11 06:39 516480 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-06-02 22:19 . 2012-06-21 19:12 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-21 19:13 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-21 19:13 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-21 19:13 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-21 19:12 35864 ----a-w- c:\windows\SysWow64\wups.dll
2012-06-02 22:19 . 2012-06-21 19:12 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-21 19:12 577048 ----a-w- c:\windows\SysWow64\wuapi.dll
2012-06-02 22:15 . 2012-06-21 19:13 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-21 19:12 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 22:12 . 2012-06-21 19:12 88576 ----a-w- c:\windows\SysWow64\wudriver.dll
2012-06-02 19:19 . 2012-06-21 19:12 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:19 . 2012-06-21 19:12 171904 ----a-w- c:\windows\SysWow64\wuwebv.dll
2012-06-02 19:15 . 2012-06-21 19:12 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 19:12 . 2012-06-21 19:12 33792 ----a-w- c:\windows\SysWow64\wuapp.exe
2012-06-02 12:49 . 2012-07-11 07:00 17807360 ----a-w- c:\windows\system32\mshtml.dll
2012-06-02 12:17 . 2012-07-11 07:00 10924032 ----a-w- c:\windows\system32\ieframe.dll
2012-06-02 12:12 . 2012-07-11 07:00 2311680 ----a-w- c:\windows\system32\jscript9.dll
2012-06-02 12:05 . 2012-07-11 07:00 1346048 ----a-w- c:\windows\system32\urlmon.dll
2012-06-02 12:05 . 2012-07-11 07:00 1392128 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 12:04 . 2012-07-11 07:00 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-02 12:04 . 2012-07-11 07:00 237056 ----a-w- c:\windows\system32\url.dll
2012-06-02 12:03 . 2012-07-11 07:00 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-06-02 12:01 . 2012-07-11 07:00 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-02 12:00 . 2012-07-11 07:00 818688 ----a-w- c:\windows\system32\jscript.dll
2012-06-02 11:59 . 2012-07-11 07:00 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-06-02 11:57 . 2012-07-11 07:00 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-06-02 11:57 . 2012-07-11 07:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-06-02 11:54 . 2012-07-11 07:00 248320 ----a-w- c:\windows\system32\ieui.dll
2012-06-02 08:33 . 2012-07-11 07:00 1800192 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-06-02 08:25 . 2012-07-11 07:00 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2012-06-02 08:25 . 2012-07-11 07:00 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-06-02 08:20 . 2012-07-11 07:00 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-06-02 08:16 . 2012-07-11 07:00 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-06-02 00:22 . 2012-07-11 06:39 347136 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 00:22 . 2012-07-11 06:39 254464 ----a-w- c:\windows\system32\ncrypt.dll
2012-06-02 00:05 . 2012-07-11 06:39 77312 ----a-w- c:\windows\SysWow64\secur32.dll
2012-06-02 00:04 . 2012-07-11 06:39 278528 ----a-w- c:\windows\SysWow64\schannel.dll
2012-06-02 00:03 . 2012-07-11 06:39 204288 ----a-w- c:\windows\SysWow64\ncrypt.dll
2012-05-31 16:25 . 2009-10-05 00:03 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{23C17F9A-C4AF-4701-9657-D384E3EE8958}]
2010-09-15 09:17 86696 ----a-w- c:\program files (x86)\coxtoolbartb\CoxToolbarDx.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{37153479-1976-43c3-a1ee-557513977b64}]
c:\program files (x86)\Coupons.com\prxtbCou0.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{23C17F9A-C4AF-4701-9657-D384E3EE8958}"= "c:\program files (x86)\coxtoolbartb\CoxToolbarDx.dll" [2010-09-15 86696]
"{37153479-1976-43c3-a1ee-557513977b64}"= "c:\program files (x86)\Coupons.com\prxtbCou0.dll" [BU]
"{8660E5B3-6C41-44DE-8503-98D99BBECD41}"= "c:\program files (x86)\Coupons.com CouponBar\tbcore3.dll" [2012-02-06 2664864]
.
[HKEY_CLASSES_ROOT\clsid\{23c17f9a-c4af-4701-9657-d384e3ee8958}]
.
[HKEY_CLASSES_ROOT\clsid\{37153479-1976-43c3-a1ee-557513977b64}]
.
[HKEY_CLASSES_ROOT\clsid\{8660e5b3-6c41-44de-8503-98d99bbecd41}]
[HKEY_CLASSES_ROOT\TBSB07898.TBSB07898.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB07898.TBSB07898]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]
"Weather"="c:\program files (x86)\AWS\WeatherBug\Weather.exe" [2010-10-29 1652736]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-15 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdatePDIRShortCut"="c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2009-02-02 210216]
"TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2009-04-10 1328424]
"CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2009-04-10 185640]
"DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2009-03-19 1148200]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2009-11-04 597792]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2009-2-9 430080]
Wireless Connection Manager.lnk - c:\program files (x86)\D-Link\DWA-131 revA\wirelesscm.exe [2010-7-23 496896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SEP]
c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-14 250056]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 21:35]
.
2012-08-18 c:\windows\Tasks\FreeFileViewerUpdateChecker.job
- c:\program files (x86)\FreeFileViewer\FFVCheckForUpdates.exe [2012-02-14 19:24]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-27 00:19]
.
2012-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-27 00:19]
.
2012-08-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-635047954-3736312933-3277114742-1000Core.job
- c:\users\Sheila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-31 11:42]
.
2012-08-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-635047954-3736312933-3277114742-1000UA.job
- c:\users\Sheila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-31 11:42]
.
2012-08-18 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-11-16 10:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Remote Software"="c:\program files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exe" [2009-02-06 172032]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-05 154648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-05 227352]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-05 202264]
"SmartMenu"="c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [BU]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-12-04 186904]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 182784]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/?affID=113959&tt=190712_ctrl_2912_1&babsrc=HP_ss&mntrId=96feff1e0000000000000018e7cd0ac0
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Sheila\AppData\Roaming\Mozilla\Firefox\Profiles\jnd2v57a.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-dlink-chromesbox-en-us
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://search.coupons.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=2&q=
FF - user.js: general.useragent.extra.brc - BRI/1
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extensions.BabylonToolbar_i.babTrack, affID=113959&tt=190712_ctrl_2912_1
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 96feff1e0000000000000018e7cd0ac0
FF - user.js: extensions.BabylonToolbar_i.hardId - 96feff1e0000000000000018e7cd0ac0
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15540
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1713:13
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\SepMasterService]
"ImagePath"="\"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe\" /s \"Symantec Endpoint Protection\" /m \"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\sms.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\SmcService]
"ImagePath"="\"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Symantec\Symantec Endpoint Protection\CurrentVersion]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2012-08-18 10:24:00
ComboFix-quarantined-files.txt 2012-08-18 14:23
ComboFix2.txt 2012-08-17 12:17
.
Pre-Run: 399,292,669,952 bytes free
Post-Run: 399,243,112,448 bytes free
.
- - End Of File - - BF4606853B35E6DC9A8877DE5AE4C8F5
  • 0

#11
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Combofix did great job. How is your system now? Problems?

Please download Farbar Service Scanner and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

  • 0

#12
jfstrat

jfstrat

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
The system has been running great so far. Thanks! Here is the FSS log:

Farbar Service Scanner Version: 06-08-2012
Ran by Sheila (administrator) on 20-08-2012 at 19:04:59
Running from "C:\Users\Sheila\Downloads"
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============
BITS Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to retrieve start type of BITS. The value does not exist.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.


Windows Autoupdate Disabled Policy:
============================


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcsvc.dll
[2009-12-03 10:24] - [2009-04-11 03:11] - 0268288 ____A (Microsoft Corporation) 3ED0321127CE70ACDAABBF77E157C2A7

C:\Windows\System32\drivers\afd.sys
[2012-02-15 01:37] - [2012-01-03 10:25] - 0404992 ____A (Microsoft Corporation) C4F6CE6087760AD70960C9EB130E7943

C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2012-05-09 23:36] - [2012-03-30 08:45] - 1423744 ____A (Microsoft Corporation) 46D448E9117464E4D3BBF36D7E3FA48E

C:\Windows\System32\dnsrslvr.dll
[2011-04-15 00:21] - [2011-03-02 12:12] - 0117760 ____A (Microsoft Corporation) 06230F1B721494A6DF8D47FD395BB1B0

C:\Windows\System32\mpssvc.dll
[2009-12-03 10:25] - [2009-04-11 03:11] - 0603136 ____A (Microsoft Corporation) 897E3BAF68BA406A61682AE39C83900C

C:\Windows\System32\bfe.dll
[2009-12-03 10:24] - [2009-04-11 03:11] - 0458240 ____A (Microsoft Corporation) FFB96C2589FFA60473EAD78B39FBDE29

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe
[2009-12-03 10:25] - [2009-04-11 03:11] - 1433600 ____A (Microsoft Corporation) B75232DAD33BFD95BF6F0A3E6BFF51E1

C:\Windows\System32\wscsvc.dll
[2009-12-03 10:24] - [2009-04-11 03:11] - 0074752 ____A (Microsoft Corporation) 9EA3E6D0EF7A5C2B9181961052A4B01A

C:\Windows\System32\wbem\WMIsvc.dll
[2009-12-03 10:24] - [2009-04-11 03:11] - 0221696 ____A (Microsoft Corporation) D2E7296ED1BD26D8DB2799770C077A02

C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll
[2009-12-03 10:25] - [2009-04-11 03:11] - 1081856 ____A (Microsoft Corporation) 6D316F4859634071CC25C4FD4589AD2C

C:\Windows\System32\es.dll
[2009-12-03 10:25] - [2009-04-11 03:11] - 0361984 ____A (Microsoft Corporation) E12F22B73F153DECE721CD45EC05B4AF

C:\Windows\System32\cryptsvc.dll
[2012-06-13 13:16] - [2012-04-23 12:25] - 0174592 ____A (Microsoft Corporation) 62740B9D2A137E8CED41A9E4239A7A31

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll
[2009-12-03 10:25] - [2009-04-11 03:11] - 0719872 ____A (Microsoft Corporation) CF8B9A3A5E7DC57724A89D0C3E8CF9EF



**** End of log ****
  • 0

#13
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hi jfstrat,

Glad to hear that. Your logs and system are clean now. I'm glad we fix up your computer.

Step 1

Please close all running programs and Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL

    :Commands
    [purity]
    [emptytemp]
    [resethosts]
    [clearallrestorepoints]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
Step 2

We need to clean up your PC from programs we used.

Please start OTL one more time and click CleanUp button. OTL will restart your system at the end.

In case that any of the software we used in this fix still remains on your system please delete it manually (Right click on it and select Delete).

General recommendations

Here are some recommendations you should follow to minimize infection risk in the future:

1. Something to read

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

2. Make Backups of Important Files

Please read this article Home Computer Data Backup.

3. Regularly update your software

To eliminate design flaws and security vulnerabilities, all software needs to be updated to the latest version or the vendor’s patch installed.

You should download Update Checker from here. The program will automaticly check for newer version of software installed on your system.
  • 0

#14
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP