[redghia]

Hey guys, Im having problems with random sites loading such as target.com & isearc-h.com,

I have update and run the following

Microsoft Antispyware, Trend 2005, Spybot, Ad-aware, Ewido, Ccleaner, Cleanup and Winpatrol

I have Posted Hijackthis log & Microsoft antispyware log, and a file which lists changes to the hosts , I also have long term issues with Cram Toolbar installer which i have posted here before and thought were resolved ---Seems that they just died down for a day or so


Thanks in advance for any help


Regards,

Ash
_________________________________________________________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 7:22:54 PM, on 26/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\PROGRA~1\TWEAKM~1\TMTray.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ashley\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [TweakMASTER] "C:\PROGRA~1\TWEAKM~1\TMTray.exe"
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MSN Messenger.lnk = C:\Program Files\MSN Messenger\msnmsgr.exe
O4 - Startup: SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13....es/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.co...clean_micro.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124188782390
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zon...ot.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O18 - Protocol: bw+0 - {BBD517CC-DE59-4465-A135-694E1859EF1D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\en6sl1j71.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe



_________________________________________________________________________________________

Spyware Scan Details
Start Date: 23/10/2005 5:11:34 PM
End Date: 23/10/2005 5:19:56 PM
Total Time: 8 mins 22 secs

Detected Threats

IST.ISTbar Browser Modifier more information...
Details: ISTbar is an Internet Explorer redirector that modifies your homepage and searches without your consent using an Internet Explorer toolbar.
Status: Removed
Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.

Infected folders detected
c:\program files\istsvc

Infected registry keys/values detected
HKEY_CURRENT_USER\software\ist
HKEY_CURRENT_USER\software\ist InstallDate 2005-10-23 07:40:35
HKEY_CURRENT_USER\software\ist account_id 1003585
HKEY_CURRENT_USER\software\ist config ysb_l3


180Solutions.SearchAssistant Adware more information...
Details: 180Solutions.SearchAssistant monitors your current Web browsing activity and displays pop-up advertisements related to the Internet sites you are viewing.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\windows\msresearch.exe

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run msresearch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run msresearch


IST.SideFind Adware more information...
Details: SideFind installs an adware Internet Explorer browser helper object that installs some extra buttons.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\documents and settings\ashley\local settings\temp\sidefind.exe


Adware.cmdService Adware more information...
Details: Adware.cmdService runs as a Windows service.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
C:\WINDOWS\QXNobGV5\command.exe


IST.PowerScan Adware more information...
Details: PowerScan is advertised through in ordinary web pop-ups, but recently it started to install with help from the the ISTBar adware.
Status: Removed
High threat - High-risk items have a large potential for harm, such as loss of computer control, and should be removed unless knowingly installed.

Infected files detected
c:\program files\power scan\powerscan.exe
C:\Program Files\Power Scan\uninstall.exe
c:\documents and settings\ashley\start menu\programs\power scan\power scan.lnk

Infected folders detected
c:\documents and settings\ashley\start menu\programs\power scan
c:\program files\power scan

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Power Scan
HKEY_CURRENT_USER\software\powerscan
HKEY_CURRENT_USER\software\powerscan account_id 1003585
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\Power Scan
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\Power Scan DisplayName Power Scan
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\Power Scan UninstallString C:\Program Files\Power Scan\uninstall.exe


UCmore Potentially Unwanted Software more information...
Status: Removed
Elevated threat - Elevated-risk items have some potential for harm. Users should review such programs and remove them if unwanted.

Infected files detected
C:\ucmoreiex.exe


RealVNC Remote Control Software more information...
Details: RealVNC (Virtual Network Computing) allows a computer to view and interact with any other computer or mobile device on the Internet.
Status: Ignored
Moderate threat - Moderate-risk items have some potential for harm, but may be part of a wanted service. Users may decide to ignore such programs after review.

Infected files detected
C:\Program Files\RealVNC\VNC4\WinVNC4.exe

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\Software\RealVNC
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 IdleTimeout 3600
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 HTTPPortNumber 5800
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 LocalHost 0
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 Hosts +,
HKEY_LOCAL_MACHINE\Software\RealVNC WinVNC4_License ZMQAU-ZKXY5-DMYMZ-496JX-HKADN5da91b74
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4\Security Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4\Enum 0 Root\LEGACY_WINVNC4\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4\Enum Count 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4\Enum NextInstance 1
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 Password
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4 Type 272
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4 Start 4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4 ErrorControl 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4 ImagePath "C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4 DisplayName VNC Server Version 4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVNC4 ObjectName LocalSystem
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 SecurityTypes RA2
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 ReverseSecurityTypes RA2
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 UserPasswdVerifier VncAuth
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 QueryConnect 0
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 QueryOnlyIfLoggedOn 0
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4
HKEY_LOCAL_MACHINE\Software\RealVNC\WinVNC4 PortNumber 5900


Detected Spyware Cookies
No spyware cookies were found during this scan.

_________________________________________________________________________________________


# Copyright © 1993-1999 Microsoft Corp.
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
# For example:
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
127.0.0.1 www.igetnet.com
127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1 www.clrsch.com
127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com
127.0.0.1 www.qoolaid.com
127.0.0.1 www.qoologic.com
127.0.0.1 www.CLKPrecision.com
127.0.0.1 www.urllogic.com
127.0.0.1 www.clkoptimizer.com
127.0.0.1 www.isearch.com
127.0.0.1 isearch.com
127.0.0.1 www.idownload.com
127.0.0.1 idownload.com
127.0.0.1 www.mytotalsearch.com
127.0.0.1 mytotalsearch.com
127.0.0.1 www.lop.com
127.0.0.1 lop.com
127.0.0.1 www.websearch.com
127.0.0.1 websearch.com
127.0.0.1 www.page-not-found.net
127.0.0.1 page-not-found.net
127.0.0.1 www.isearchhere.com
127.0.0.1 isearchhere.com
127.0.0.1 xads.offeroptimizer.comm
127.0.0.1 search.offeroptimizer.com
127.0.0.1 ximages.offeroptimizer.com
127.0.0.1 xlime.offeroptimizer.com
127.0.0.1 xadsj-o.offeroptimizer.com
127.0.0.1 xadsj.offeroptimizer.com
127.0.0.1 www.offeroptimizer.com
127.0.0.1 as.adwave.com
127.0.0.1 sr.adwave.com
127.0.0.1 www.adwave.com
127.0.0.1 adwave.com EVENT:HOST:127.0.0.1
127.0.0.1 adwave.com EVENT:HOST:127.0.0.1
127.0.0.1 adwave.com EVENT:HOST:127.0.0.1
127.0.0.1 adwave.com EVENT:HOST:127.0.0.1
127.0.0.1 adwave.com EVENT:HOST:127.0.0.1

[Advertisements]

I got exactly the same problems.

After using all kinds of anti-spyware software: microsoft, counterspy, Hijackthis, ewdio, spyware doctor, spybot, spywareblast, ad-ware. There are still some spyware cannot be removed (Everytime I removed them, they come back again in the next scan).
Below is the spyware I still found in my system:
Ist bar
look2me
adware.cmdService

And the hostfile also goes wrong.

Can anyone help us.

[tysunset]

I got exactly the same problems.

After using all kinds of anti-spyware software: microsoft, counterspy, Hijackthis, ewdio, spyware doctor, spybot, spywareblast, ad-ware. There are still some spyware cannot be removed (Everytime I removed them, they come back again in the next scan).
Below is the spyware I still found in my system:
Ist bar
look2me
adware.cmdService

And the hostfile also goes wrong.

Can anyone help us.

[Armodeluxe]

tysunset, if you need help please follow the instructions in this topic and then start a new topic of your own..

http://www.geekstogo...indpost&p=12367

Hi Ash,

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.

[redghia]

Hey, Thanks for your reply. The problem seem to be getting worse with me getting locked out of the net last night until i ran spybot and ad-aware


L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Setup]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\l28mlcl11fq.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\frcfg.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{9D40D638-613B-D136-DA60-19F06B3193A4}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device"
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device ContextMenuHandler"
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}"="Siemens SX1 PropertySheetHandler"
"{48F45200-91E6-11CE-8A4F-0080C81A28D4}"="TMD Shell Extension"
"{771A9DA0-731A-11CE-993C-00AA004ADB6C}"="VBPropSheet"
"{08625A55-6B3A-4109-88D8-56E8E333BB5E}"=""
"{E1322F09-02B6-4E72-B5CC-6B795E758A7B}"=""
"{FFF53BEF-BDA8-4AE2-8132-1ED35E97AD8C}"=""
"{52873B9C-4FB9-4D86-9A8F-80B81F2BB70D}"=""
"{5C9B06B7-04C7-4023-A090-A8008C37FABF}"=""
"{DAF11285-46F9-45A4-8383-F7A1EBE87E8F}"=""
"{A0BBE383-78E3-4C73-8128-1180B21D6A01}"=""
"{4683E64C-B125-495F-86F4-BFB5247CEDB8}"=""
"{E2CFB238-033C-429C-AEA0-4BFA6AF41BC9}"=""
"{EAA67C8D-5396-4ED9-9070-F1E9C30EB045}"=""
"{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension"
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{338A5538-4F3F-4DFE-8A14-E18D6E2EE8F1}"=""
"{5F98A4B6-CD25-42E8-81F2-2D6F392D1A84}"=""
"{ECDB9291-581E-441F-BBFB-A5DD3E73A550}"=""
"{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}"=""
"{F7F4E57E-2EBA-4123-903B-F1B85C40F791}"=""
"{E47953F8-125D-44A3-B6AF-B9C476F91E80}"=""
"{CD8D6C15-0BB8-4BDD-BA31-D79166660EEE}"=""
"{D3E9B3D1-22C7-4218-BA26-C0870B87441E}"=""
"{C25B7CF2-04EB-4FEF-BDD1-E937FC107EA2}"=""
"{8DF69A41-8595-4603-9687-17878366E970}"=""
"{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}"=""
"{90297BEE-CA79-485B-A504-50437C73BC1C}"=""
"{AADB38B6-0FCF-4658-B241-0768463432A2}"=""
"{CE85D680-9227-4EC0-9011-CF8F65BF9C69}"=""
"{40A0BE73-1DA1-47A9-964D-69207A2B5055}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}\InprocServer32]
@="C:\\WINDOWS\\system32\\frcfg.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\InprocServer32]
@="C:\\WINDOWS\\system32\\jxdw400.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\InprocServer32]
@="C:\\WINDOWS\\system32\\ltXbm12n.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\InprocServer32]
@="C:\\WINDOWS\\system32\\UbinstGMT.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
browseui.dll Sat 3 Sep 2005 10:22:04 A.... 1,019,904 996.00 K
cdfview.dll Sat 3 Sep 2005 10:22:04 A.... 151,040 147.50 K
cdosys.dll Sat 10 Sep 2005 12:23:42 A.... 2,067,968 1.97 M
cwedui.dll Mon 31 Oct 2005 17:30:40 ..S.R 233,794 228.31 K
danim.dll Sat 3 Sep 2005 10:22:04 A.... 1,053,696 1.00 M
dxtrans.dll Sat 3 Sep 2005 10:22:04 A.... 205,312 200.50 K
extmgr.dll Sat 3 Sep 2005 10:22:04 ..... 55,808 54.50 K
fp0m03~1.dll Thu 3 Nov 2005 20:57:50 ..S.R 234,218 228.73 K
frcfg.dll Thu 3 Nov 2005 21:01:50 ..S.R 234,218 228.73 K
ib50_32.dll Wed 2 Nov 2005 17:32:26 ..S.R 234,218 228.73 K
iepeers.dll Sat 3 Sep 2005 10:22:04 A.... 251,392 245.50 K
inseng.dll Sat 3 Sep 2005 10:22:04 A.... 96,256 94.00 K
jxdw400.dll Tue 1 Nov 2005 16:34:42 ..S.R 233,794 228.31 K
linkinfo.dll Thu 1 Sep 2005 12:11:54 A.... 19,968 19.50 K
ltl027~1.dll Tue 1 Nov 2005 17:09:24 ..S.R 233,794 228.31 K
ltxbm12n.dll Tue 1 Nov 2005 19:30:12 ..S.R 236,849 231.30 K
mbsreg~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,112 25.50 K
mbsuse~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,624 26.00 K
mbswin~1.dll Fri 9 Sep 2005 8:23:10 A.... 51,200 50.00 K
mshtml.dll Tue 4 Oct 2005 18:26:00 A.... 3,015,168 2.88 M
mshtmled.dll Sat 3 Sep 2005 10:22:06 A.... 448,512 438.00 K
msrating.dll Sat 3 Sep 2005 10:22:06 A.... 146,432 143.00 K
mstime.dll Sat 3 Sep 2005 10:22:06 A.... 530,432 518.00 K
n2n6lc~1.dll Thu 3 Nov 2005 17:55:32 ..S.R 236,849 231.30 K
netman.dll Tue 23 Aug 2005 4:59:46 A.... 197,632 193.00 K
pngfilt.dll Sat 3 Sep 2005 10:22:06 A.... 39,424 38.50 K
quartz.dll Tue 30 Aug 2005 14:43:42 A.... 1,287,680 1.23 M
rbap350.dll Fri 9 Sep 2005 8:23:10 A.... 60,416 59.00 K
rbrege~1.dll Fri 9 Sep 2005 8:23:10 A.... 73,216 71.50 K
rbsele~1.dll Fri 9 Sep 2005 8:23:10 A.... 27,648 27.00 K
rbspri~1.dll Fri 9 Sep 2005 8:23:10 A.... 56,832 55.50 K
shdocvw.dll Sat 3 Sep 2005 10:22:06 A.... 1,483,776 1.41 M
shell32.dll Fri 23 Sep 2005 13:35:30 A.... 8,450,560 8.06 M
shlwapi.dll Sat 3 Sep 2005 10:22:06 A.... 473,600 462.50 K
sirenacm.dll Thu 13 Oct 2005 10:41:06 A.... 118,784 116.00 K
ske.dll Fri 4 Nov 2005 8:44:46 ..S.R 234,218 228.73 K
ubinst~1.dll Thu 3 Nov 2005 15:54:30 ..S.R 236,849 231.30 K
umpnpmgr.dll Tue 23 Aug 2005 14:05:42 A.... 123,392 120.50 K
urlmon.dll Sat 3 Sep 2005 10:22:06 A.... 608,768 594.50 K
wininet.dll Sat 3 Sep 2005 10:22:06 A.... 658,432 643.00 K
winsrv.dll Thu 1 Sep 2005 12:11:54 A.... 291,840 285.00 K

41 items found: 41 files (10 H/S), 0 directories.
Total of file sizes: 25,466,625 bytes 24.29 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
atmtdd~1.tmp Sun 23 Oct 2005 18:15:08 A.... 0 0.00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 0 bytes 0.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 741B-A95D

Directory of C:\WINDOWS\System32

04/11/2005 08:44 AM 234,218 ske.dll
03/11/2005 09:50 PM 3,766 KGyGaAvL.sys
03/11/2005 09:01 PM 234,218 frcfg.dll
03/11/2005 08:57 PM 234,218 fp0m03d1e.dll
03/11/2005 08:53 PM 56 EC756A2DDD.sys
03/11/2005 05:55 PM 236,849 n2n6lc5s1f.dll
03/11/2005 03:54 PM 236,849 UbinstGMT.dll
02/11/2005 05:32 PM 234,218 ib50_32.dll
01/11/2005 07:30 PM 236,849 ltXbm12n.dll
01/11/2005 05:09 PM 233,794 ltl0273mg.dll
01/11/2005 04:34 PM 233,794 jxdw400.dll
31/10/2005 11:30 PM <DIR> dllcache
31/10/2005 05:30 PM 233,794 cwedui.dll
29/12/2004 09:50 PM <DIR> Microsoft
12 File(s) 2,352,623 bytes
2 Dir(s) 47,625,703,424 bytes free

[Armodeluxe]

Unfortunately l2mfix alone can't remove this latest version of the infection alone. We will use Spysweeper first: (in the course of the cleanup Spysweeper will ask to delete some files on reboot, please allow it to do so)

Please download WebRoot SpySweeper from HERE (It's a 2 week trial):

• Click the Free Trial link under to "SpySweeper" to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into your next reply.

Along with the Spysweeper log, please post a new l2mfix option1 log. If they don't fit in one post, make seperate posts.

[redghia]

Thanks, looks like a great program but tales about 2 hours to scan and another 2 to fix the probs

Spysweeper log


********
3:13 PM: | Start of Session, Saturday, 5 November 2005 |
3:13 PM: Spy Sweeper started
3:13 PM: Sweep initiated using definitions version 567
3:13 PM: Starting Memory Sweep
3:14 PM: Memory Sweep Complete, Elapsed Time: 00:01:03
3:14 PM: Starting Registry Sweep
3:14 PM: Found Adware: blazefind
3:14 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/admilliservx.dll\ (ID = 104525)
3:14 PM: Found Adware: deskad
3:14 PM: HKCR\deskadx.installer\ (1 subtraces) (ID = 124925)
3:14 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/deskadx.dll\ (ID = 124926)
3:14 PM: HKLM\software\classes\deskadx.installer\ (1 subtraces) (ID = 124928)
3:14 PM: Found Adware: hotbar
3:14 PM: HKLM\software\classes\typelib\{4cf5a3c1-07a2-4336-9b54-6870452ebde1}\ (9 subtraces) (ID = 127537)
3:14 PM: HKCR\typelib\{4cf5a3c1-07a2-4336-9b54-6870452ebde1}\ (9 subtraces) (ID = 127635)
3:14 PM: Found Adware: screensavers
3:14 PM: HKCR\clsid\{722d2939-a14a-41a9-9eac-ab8f4e295819}\ (2 subtraces) (ID = 140550)
3:14 PM: HKCR\clsid\{88d758a3-d33b-45fd-91e3-67749b4057fa}\ (2 subtraces) (ID = 140551)
3:14 PM: HKLM\software\classes\clsid\{722d2939-a14a-41a9-9eac-ab8f4e295819}\ (2 subtraces) (ID = 140555)
3:14 PM: HKLM\software\classes\clsid\{88d758a3-d33b-45fd-91e3-67749b4057fa}\ (2 subtraces) (ID = 140556)
3:14 PM: Found Adware: searchbar toolbar
3:14 PM: HKCR\clsid\{aa8c93e1-7e5f-497e-b67c-cc8fe2a40d3b}\ (9 subtraces) (ID = 140791)
3:14 PM: HKCR\interface\{9ce15eb5-6b39-4656-9e1f-2d219ee42e0e}\ (7 subtraces) (ID = 140792)
3:14 PM: HKLM\software\classes\clsid\{aa8c93e1-7e5f-497e-b67c-cc8fe2a40d3b}\ (9 subtraces) (ID = 140796)
3:14 PM: HKLM\software\classes\interface\{9ce15eb5-6b39-4656-9e1f-2d219ee42e0e}\ (7 subtraces) (ID = 140797)
3:14 PM: Found Adware: secureads
3:14 PM: HKLM\software\secureads\.support\ (10 subtraces) (ID = 141379)
3:14 PM: HKLM\software\secureads\.target\ (80 subtraces) (ID = 141380)
3:14 PM: Found Adware: starware toolbar
3:14 PM: HKLM\software\microsoft\windows\currentversion\uninstall\starware\ (3 subtraces) (ID = 142865)
3:14 PM: Found Trojan Horse: trojan_backdoor_retro64
3:14 PM: HKCR\interface\{450b9e4d-4014-4de3-b34e-014a81468293}\ (8 subtraces) (ID = 144995)
3:14 PM: HKLM\software\classes\interface\{450b9e4d-4014-4de3-b34e-014a81468293}\ (8 subtraces) (ID = 145000)
3:14 PM: HKLM\software\classes\typelib\{c7f00a9a-f1bc-436e-82c7-e8cae6fd67f7}\ (9 subtraces) (ID = 145003)
3:14 PM: HKCR\typelib\{c7f00a9a-f1bc-436e-82c7-e8cae6fd67f7}\ (9 subtraces) (ID = 145004)
3:14 PM: Found Adware: winad
3:14 PM: HKCR\prevadx.installer\ (1 subtraces) (ID = 147161)
3:14 PM: HKLM\software\classes\prevadx.installer\ (1 subtraces) (ID = 147175)
3:14 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/hbinstie.dll\ (2 subtraces) (ID = 484423)
3:14 PM: HKLM\software\secureads\ (34203 subtraces) (ID = 645796)
3:14 PM: HKCR\interface\{175816a5-219e-4079-b2f9-53c501c409ba}\ (7 subtraces) (ID = 774223)
3:14 PM: HKCR\interface\{38370864-346f-4afa-8c4b-4fbff518c0bb}\ (8 subtraces) (ID = 774268)
3:14 PM: HKCR\interface\{8a61a950-c325-4f44-ba64-273180ff3464}\ (7 subtraces) (ID = 774358)
3:14 PM: HKCR\interface\{b53d4cd4-406d-43cc-8244-7893d72236dd}\ (7 subtraces) (ID = 774394)
3:14 PM: HKCR\interface\{b9bb3219-f84c-4060-966b-4a1e73e24226}\ (7 subtraces) (ID = 774412)
3:14 PM: HKCR\interface\{f786cb18-3809-4e49-bc99-9a66da47db8b}\ (7 subtraces) (ID = 774457)
3:14 PM: HKLM\software\classes\interface\{175816a5-219e-4079-b2f9-53c501c409ba}\ (7 subtraces) (ID = 774499)
3:14 PM: HKLM\software\classes\interface\{38370864-346f-4afa-8c4b-4fbff518c0bb}\ (8 subtraces) (ID = 774544)
3:14 PM: HKLM\software\classes\interface\{8a61a950-c325-4f44-ba64-273180ff3464}\ (7 subtraces) (ID = 774634)
3:14 PM: HKLM\software\classes\interface\{b53d4cd4-406d-43cc-8244-7893d72236dd}\ (7 subtraces) (ID = 774670)
3:14 PM: HKLM\software\classes\interface\{b9bb3219-f84c-4060-966b-4a1e73e24226}\ (7 subtraces) (ID = 774688)
3:14 PM: HKLM\software\classes\interface\{f786cb18-3809-4e49-bc99-9a66da47db8b}\ (7 subtraces) (ID = 774733)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\hbtools\ (194 subtraces) (ID = 127563)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\hotbar\ (201 subtraces) (ID = 127565)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\microsoft\internet explorer\extensions\cmdmapping\ || {e77eda01-3c56-4a96-8d08-02b42891c169} (ID = 127576)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\shopperreports\ (3 subtraces) (ID = 127631)
3:14 PM: Found Adware: marketscore
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\netsetter\ (3 subtraces) (ID = 134770)
3:14 PM: Found Adware: 180search assistant/zango
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\salm\ (3 subtraces) (ID = 135792)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\e-ventures n.v.\ (3 subtraces) (ID = 140801)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\starware\ (13 subtraces) (ID = 142866)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\netsetter\ossproxy\settings\ (1 subtraces) (ID = 635458)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\microsoft\installer\features\10b0642b36134f8f914ea8e11ee5b503\ (1 subtraces) (ID = 788006)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1008\software\microsoft\installer\products\d493500bd4a54ea6bc805fc9cda952c5\ (2 subtraces) (ID = 788008)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1007\software\hotbar\ (222 subtraces) (ID = 127565)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1007\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1007\software\microsoft\internet explorer\extensions\cmdmapping\ || {e77eda01-3c56-4a96-8d08-02b42891c169} (ID = 127576)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1007\software\shopperreports\ (1 subtraces) (ID = 127631)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1007\software\salm\ (3 subtraces) (ID = 135792)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1007\software\e-ventures n.v.\ (3 subtraces) (ID = 140801)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1007\software\starware\ (11 subtraces) (ID = 142866)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\hbtools\ (160 subtraces) (ID = 127563)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\microsoft\internet explorer\extensions\cmdmapping\ || {e77eda01-3c56-4a96-8d08-02b42891c169} (ID = 127576)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\microsoft\internet explorer\toolbar\webbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 127586)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\saie\ (16 subtraces) (ID = 135788)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\salm\ (3 subtraces) (ID = 135792)
3:14 PM: Found Adware: directrevenue-abetterinternet
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\ceres\ (ID = 145851)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\microsoft\installer\features\10b0642b36134f8f914ea8e11ee5b503\ (1 subtraces) (ID = 788006)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1006\software\microsoft\installer\products\d493500bd4a54ea6bc805fc9cda952c5\ (2 subtraces) (ID = 788008)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1005\software\hotbar\ (246 subtraces) (ID = 127565)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1005\software\microsoft\internet explorer\extensions\cmdmapping\ || {946b3e9e-e21a-49c8-9f63-900533fafe14} (ID = 127575)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1005\software\microsoft\internet explorer\extensions\cmdmapping\ || {e77eda01-3c56-4a96-8d08-02b42891c169} (ID = 127576)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1005\software\shopperreports\ (1 subtraces) (ID = 127631)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1005\software\saie\ (14 subtraces) (ID = 135788)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1005\software\salm\ (3 subtraces) (ID = 135792)
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1005\software\e-ventures n.v.\ (3 subtraces) (ID = 140801)
3:14 PM: Found Adware: targetsaver
3:14 PM: HKU\WRSS_Profile_S-1-5-21-57989841-1972579041-839522115-1004\software\tsl2\ (1 subtraces) (ID = 143616)
3:15 PM: Registry Sweep Complete, Elapsed Time:00:00:43
3:15 PM: Starting Cookie Sweep
3:15 PM: Found Spy Cookie: yieldmanager cookie
3:15 PM: [email protected][1].txt (ID = 3751)
3:15 PM: Found Spy Cookie: belnk cookie
3:15 PM: guest@belnk[1].txt (ID = 2292)
3:15 PM: Found Spy Cookie: casalemedia cookie
3:15 PM: guest@casalemedia[2].txt (ID = 2354)
3:15 PM: [email protected][2].txt (ID = 2293)
3:15 PM: Found Spy Cookie: statcounter cookie
3:15 PM: guest@statcounter[1].txt (ID = 3447)
3:15 PM: Found Spy Cookie: tribalfusion cookie
3:15 PM: guest@tribalfusion[1].txt (ID = 3589)
3:15 PM: Found Spy Cookie: primaryads cookie
3:15 PM: [email protected][2].txt (ID = 3190)
3:15 PM: Found Spy Cookie: 3 cookie
3:15 PM: deryk@3[2].txt (ID = 1959)
3:15 PM: deryk@3[3].txt (ID = 1959)
3:15 PM: deryk@3[4].txt (ID = 1959)
3:15 PM: deryk@3[5].txt (ID = 1959)
3:15 PM: Found Spy Cookie: 64.62.232 cookie
3:15 PM: [email protected][1].txt (ID = 1987)
3:15 PM: Found Spy Cookie: 888 cookie
3:15 PM: deryk@888[2].txt (ID = 2019)
3:15 PM: deryk@888[3].txt (ID = 2019)
3:15 PM: Found Spy Cookie: websponsors cookie
3:15 PM: [email protected][2].txt (ID = 3665)
3:15 PM: Found Spy Cookie: about cookie
3:15 PM: deryk@about[2].txt (ID = 2037)
3:15 PM: Found Spy Cookie: ad-rotator cookie
3:15 PM: deryk@ad-rotator[2].txt (ID = 2051)
3:15 PM: [email protected][2].txt (ID = 3751)
3:15 PM: Found Spy Cookie: adknowledge cookie
3:15 PM: deryk@adknowledge[1].txt (ID = 2072)
3:15 PM: Found Spy Cookie: hbmediapro cookie
3:15 PM: [email protected][2].txt (ID = 2768)
3:15 PM: Found Spy Cookie: hotbar cookie
3:15 PM: [email protected][2].txt (ID = 4207)
3:15 PM: Found Spy Cookie: atlas dmt cookie
3:15 PM: deryk@atdmt[1].txt (ID = 2253)
3:15 PM: [email protected][2].txt (ID = 2293)
3:15 PM: deryk@belnk[1].txt (ID = 2292)
3:15 PM: Found Spy Cookie: burstnet cookie
3:15 PM: deryk@burstnet[2].txt (ID = 2336)
3:15 PM: deryk@casalemedia[1].txt (ID = 2354)
3:15 PM: Found Spy Cookie: cassava cookie
3:15 PM: deryk@cassava[1].txt (ID = 2362)
3:15 PM: Found Spy Cookie: columbiahouse cookie
3:15 PM: deryk@columbiahouse[1].txt (ID = 2443)
3:15 PM: Found Spy Cookie: cursorzone cookie
3:15 PM: deryk@cursorzone[1].txt (ID = 2479)
3:15 PM: [email protected][2].txt (ID = 2293)
3:15 PM: Found Spy Cookie: touchclarity cookie
3:15 PM: [email protected][1].txt (ID = 3566)
3:15 PM: Found Spy Cookie: gamespy cookie
3:15 PM: deryk@gamespy[1].txt (ID = 2719)
3:15 PM: Found Spy Cookie: go2net.com cookie
3:15 PM: deryk@go2net[1].txt (ID = 2730)
3:15 PM: deryk@hotbar[1].txt (ID = 2797)
3:15 PM: Found Spy Cookie: hypertracker.com cookie
3:15 PM: deryk@hypertracker[2].txt (ID = 2817)
3:15 PM: Found Spy Cookie: screensavers.com cookie
3:15 PM: [email protected][2].txt (ID = 3298)
3:15 PM: Found Spy Cookie: ic-live cookie
3:15 PM: deryk@ic-live[1].txt (ID = 2821)
3:15 PM: Found Spy Cookie: infospace cookie
3:15 PM: deryk@infospace[2].txt (ID = 2865)
3:15 PM: Found Spy Cookie: monstermarketplace cookie
3:15 PM: deryk@monstermarketplace[1].txt (ID = 3006)
3:15 PM: [email protected][1].txt (ID = 2866)
3:15 PM: Found Spy Cookie: mycoolscreen cookie
3:15 PM: deryk@mycoolscreen[2].txt (ID = 3033)
3:15 PM: Found Spy Cookie: mywebsearch cookie
3:15 PM: deryk@mywebsearch[1].txt (ID = 3051)
3:15 PM: Found Spy Cookie: overture cookie
3:15 PM: [email protected][1].txt (ID = 3106)
3:15 PM: [email protected][2].txt (ID = 2038)
3:15 PM: Found Spy Cookie: rn11 cookie
3:15 PM: deryk@rn11[1].txt (ID = 3261)
3:15 PM: Found Spy Cookie: servlet cookie
3:15 PM: deryk@servlet[1].txt (ID = 3345)
3:15 PM: [email protected][1].txt (ID = 3566)
3:15 PM: deryk@tribalfusion[1].txt (ID = 3589)
3:15 PM: [email protected][1].txt (ID = 3034)
3:15 PM: [email protected][2].txt (ID = 3298)
3:15 PM: Found Spy Cookie: starware.com cookie
3:15 PM: [email protected][1].txt (ID = 3442)
3:15 PM: Found Spy Cookie: xiti cookie
3:15 PM: deryk@xiti[1].txt (ID = 3717)
3:15 PM: Found Spy Cookie: yadro cookie
3:15 PM: deryk@yadro[1].txt (ID = 3743)
3:15 PM: lloyd@3[1].txt (ID = 1959)
3:15 PM: [email protected][1].txt (ID = 1987)
3:15 PM: [email protected][3].txt (ID = 1987)
3:15 PM: [email protected][1].txt (ID = 2038)
3:15 PM: [email protected][2].txt (ID = 3665)
3:15 PM: lloyd@about[2].txt (ID = 2037)
3:15 PM: lloyd@ad-rotator[2].txt (ID = 2051)
3:15 PM: Found Spy Cookie: 4u.pl cookie
3:15 PM: [email protected][1].txt (ID = 1978)
3:15 PM: [email protected][1].txt (ID = 3751)
3:15 PM: [email protected][2].txt (ID = 2768)
3:15 PM: [email protected][2].txt (ID = 4207)
3:15 PM: Found Spy Cookie: pointroll cookie
3:15 PM: [email protected][1].txt (ID = 3148)
3:15 PM: Found Spy Cookie: starpulse cookie
3:15 PM: [email protected][1].txt (ID = 3440)
3:15 PM: Found Spy Cookie: adultfriendfinder cookie
3:15 PM: lloyd@adultfriendfinder[1].txt (ID = 2165)
3:15 PM: Found Spy Cookie: ask cookie
3:15 PM: lloyd@ask[1].txt (ID = 2245)
3:15 PM: [email protected][1].txt (ID = 2293)
3:15 PM: lloyd@belnk[2].txt (ID = 2292)
3:15 PM: Found Spy Cookie: bizrate cookie
3:15 PM: lloyd@bizrate[2].txt (ID = 2308)
3:15 PM: lloyd@burstnet[2].txt (ID = 2336)
3:15 PM: Found Spy Cookie: cardomain cookie
3:15 PM: lloyd@cardomain[2].txt (ID = 2350)
3:15 PM: Found Spy Cookie: dealtime cookie
3:15 PM: lloyd@dealtime[1].txt (ID = 2505)
3:15 PM: Found Spy Cookie: did-it cookie
3:15 PM: lloyd@did-it[2].txt (ID = 2523)
3:15 PM: [email protected][1].txt (ID = 2293)
3:15 PM: Found Spy Cookie: ru4 cookie
3:15 PM: [email protected][2].txt (ID = 3269)
3:15 PM: Found Spy Cookie: go.com cookie
3:15 PM: [email protected][1].txt (ID = 2729)
3:15 PM: Found Spy Cookie: fastclick cookie
3:15 PM: lloyd@fastclick[1].txt (ID = 2651)
3:15 PM: lloyd@gamespy[2].txt (ID = 2719)
3:15 PM: Found Spy Cookie: gangbangsquad cookie
3:15 PM: lloyd@gangbangsquad[2].txt (ID = 2720)
3:15 PM: [email protected][1].txt (ID = 2038)
3:15 PM: [email protected][1].txt (ID = 2038)
3:15 PM: [email protected][1].txt (ID = 3566)
3:15 PM: lloyd@go2net[1].txt (ID = 2730)
3:15 PM: lloyd@go[1].txt (ID = 2728)
3:15 PM: [email protected][1].txt (ID = 3442)
3:15 PM: lloyd@hotbar[1].txt (ID = 2797)
3:15 PM: [email protected][1].txt (ID = 3298)
3:15 PM: lloyd@infospace[2].txt (ID = 2865)
3:15 PM: [email protected][1].txt (ID = 2729)
3:15 PM: [email protected][1].txt (ID = 2866)
3:15 PM: lloyd@mywebsearch[1].txt (ID = 3051)
3:15 PM: Found Spy Cookie: paypopup cookie
3:15 PM: lloyd@paypopup[2].txt (ID = 3119)
3:15 PM: Found Spy Cookie: pricegrabber cookie
3:15 PM: lloyd@pricegrabber[2].txt (ID = 3185)
3:15 PM: Found Spy Cookie: questionmarket cookie
3:15 PM: lloyd@questionmarket[1].txt (ID = 3217)
3:15 PM: Found Spy Cookie: rightmedia cookie
3:15 PM: lloyd@rightmedia[2].txt (ID = 3259)
3:15 PM: lloyd@rn11[2].txt (ID = 3261)
3:15 PM: Found Spy Cookie: domain sponsor cookie
3:15 PM: [email protected][1].txt (ID = 2534)
3:15 PM: Found Spy Cookie: web-stat cookie
3:15 PM: [email protected][2].txt (ID = 3649)
3:15 PM: lloyd@starware[2].txt (ID = 3441)
3:15 PM: [email protected][1].txt (ID = 2506)
3:15 PM: Found Spy Cookie: reliablestats cookie
3:15 PM: [email protected][1].txt (ID = 3254)
3:15 PM: Found Spy Cookie: clicktracks cookie
3:15 PM: [email protected][2].txt (ID = 2407)
3:15 PM: Found Spy Cookie: teensforcash cookie
3:15 PM: lloyd@teensforcash[2].txt (ID = 3509)
3:15 PM: [email protected][1].txt (ID = 2038)
3:15 PM: Found Spy Cookie: burstbeacon cookie
3:15 PM: [email protected][1].txt (ID = 2335)
3:15 PM: Found Spy Cookie: myaffiliateprogram.com cookie
3:15 PM: [email protected][1].txt (ID = 3032)
3:15 PM: [email protected][1].txt (ID = 3298)
3:15 PM: Found Spy Cookie: seeq cookie
3:15 PM: [email protected][1].txt (ID = 3332)
3:15 PM: lloyd@xiti[1].txt (ID = 3717)
3:15 PM: lloyd@yadro[1].txt (ID = 3743)
3:15 PM: Found Spy Cookie: adserver cookie
3:15 PM: [email protected][1].txt (ID = 2142)
3:15 PM: [email protected][2].txt (ID = 3751)
3:15 PM: [email protected][2].txt (ID = 2768)
3:15 PM: Found Spy Cookie: azjmp cookie
3:15 PM: evan@azjmp[2].txt (ID = 2270)
3:15 PM: evan@belnk[1].txt (ID = 2292)
3:15 PM: [email protected][2].txt (ID = 2293)
3:15 PM: [email protected][1].txt (ID = 3442)
3:15 PM: evan@rn11[2].txt (ID = 3261)
3:15 PM: Found Spy Cookie: tradedoubler cookie
3:15 PM: evan@tradedoubler[2].txt (ID = 3575)
3:15 PM: [email protected][1].txt (ID = 3442)
3:15 PM: cornelius@about[1].txt (ID = 2037)
3:15 PM: [email protected][1].txt (ID = 3751)
3:15 PM: [email protected][2].txt (ID = 2768)
3:15 PM: [email protected][2].txt (ID = 4207)
3:15 PM: cornelius@azjmp[2].txt (ID = 2270)
3:15 PM: cornelius@belnk[1].txt (ID = 2292)
3:15 PM: cornelius@bizrate[1].txt (ID = 2308)
3:15 PM: cornelius@burstnet[1].txt (ID = 2336)
3:15 PM: cornelius@cardomain[1].txt (ID = 2350)
3:15 PM: [email protected][2].txt (ID = 2293)
3:15 PM: [email protected][1].txt (ID = 2038)
3:15 PM: [email protected][2].txt (ID = 3442)
3:15 PM: Found Spy Cookie: hitstats.net cookie
3:15 PM: cornelius@hitstats[2].txt (ID = 2791)
3:15 PM: cornelius@hotbar[2].txt (ID = 2797)
3:15 PM: cornelius@hypertracker[1].txt (ID = 2817)
3:15 PM: [email protected][1].txt (ID = 3298)
3:15 PM: Found Spy Cookie: maxserving cookie
3:15 PM: cornelius@maxserving[1].txt (ID = 2966)
3:15 PM: cornelius@monstermarketplace[1].txt (ID = 3006)
3:15 PM: cornelius@mywebsearch[2].txt (ID = 3051)
3:15 PM: Found Spy Cookie: nextag cookie
3:15 PM: cornelius@nextag[1].txt (ID = 5014)
3:15 PM: cornelius@paypopup[2].txt (ID = 3119)
3:15 PM: cornelius@pricegrabber[1].txt (ID = 3185)
3:15 PM: cornelius@rightmedia[1].txt (ID = 3259)
3:15 PM: cornelius@rn11[2].txt (ID = 3261)
3:15 PM: [email protected][1].txt (ID = 2798)
3:15 PM: Found Spy Cookie: spywarestormer cookie
3:15 PM: cornelius@spywarestormer[1].txt (ID = 3417)
3:15 PM: Found Spy Cookie: tracking cookie
3:15 PM: cornelius@tracking[1].txt (ID = 3571)
3:15 PM: cornelius@tradedoubler[1].txt (ID = 3575)
3:15 PM: [email protected][1].txt (ID = 3298)
3:15 PM: [email protected][1].txt (ID = 3442)
3:15 PM: cornelius@xiti[1].txt (ID = 3717)
3:15 PM: Found Spy Cookie: 247realmedia cookie
3:15 PM: ashley@247realmedia[2].txt (ID = 1953)
3:15 PM: Found Spy Cookie: accoona cookie
3:15 PM: ashley@accoona[1].txt (ID = 2041)
3:15 PM: [email protected][1].txt (ID = 3751)
3:15 PM: [email protected][2].txt (ID = 2768)
3:15 PM: ashley@atdmt[2].txt (ID = 2253)
3:15 PM: ashley@azjmp[2].txt (ID = 2270)
3:15 PM: ashley@belnk[1].txt (ID = 2292)
3:15 PM: [email protected][2].txt (ID = 2293)
3:15 PM: [email protected][2].txt (ID = 3442)
3:15 PM: ashley@paypopup[2].txt (ID = 3119)
3:15 PM: Found Spy Cookie: pro-market cookie
3:15 PM: ashley@pro-market[1].txt (ID = 3197)
3:15 PM: ashley@rn11[2].txt (ID = 3261)
3:15 PM: ashley@statcounter[1].txt (ID = 3447)
3:15 PM: [email protected][1].txt (ID = 3032)
3:15 PM: [email protected][1].txt (ID = 3442)
3:15 PM: Cookie Sweep Complete, Elapsed Time: 00:00:25
3:15 PM: Starting File Sweep
3:15 PM: c:\documents and settings\deryk\application data\hbtools (163 subtraces) (ID = -2147480879)
3:15 PM: c:\documents and settings\evan\application data\hbtools (144 subtraces) (ID = -2147480879)
3:15 PM: c:\program files\starware (6 subtraces) (ID = -2147480223)
3:15 PM: c:\documents and settings\deryk\application data\starware (47 subtraces) (ID = -2147480225)
3:15 PM: c:\documents and settings\lloyd\application data\starware (18 subtraces) (ID = -2147480225)
3:15 PM: c:\documents and settings\cornelius\application data\shopperreports (17 subtraces) (ID = -2147480876)
3:15 PM: c:\program files\screensavers.com (5 subtraces) (ID = -2147480365)
3:15 PM: c:\documents and settings\all users\application data\starware (15 subtraces) (ID = -2147480224)
3:15 PM: c:\documents and settings\deryk\application data\shopperreports (17 subtraces) (ID = -2147480876)
3:15 PM: c:\documents and settings\deryk\application data\hotbar (563 subtraces) (ID = -2147480877)
3:15 PM: c:\documents and settings\cornelius\application data\hotbar (1060 subtraces) (ID = -2147480877)
3:15 PM: c:\documents and settings\lloyd\application data\shopperreports (17 subtraces) (ID = -2147480876)
3:15 PM: c:\documents and settings\lloyd\application data\hotbar (358 subtraces) (ID = -2147480877)
3:15 PM: Found Adware: whenu
3:15 PM: c:\documents and settings\deryk\start menu\programs\whenu (3 subtraces) (ID = -2147480383)
3:16 PM: d_icons_buttons_bbar7.xip (ID = 114343)
3:16 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:16 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:16 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:16 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:16 PM: d_icons_buttons_bbar6.xip (ID = 114394)
3:16 PM: d_icons_buttons_bbar9.xip (ID = 114377)
3:16 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:16 PM: d_icons_buttons_bbar5.xip (ID = 114376)
3:16 PM: d_icons_buttons_bbar4.xip (ID = 114355)
3:16 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:16 PM: d_icons_buttons_bbar3.xip (ID = 114342)
3:16 PM: d_icons_buttons_bbar1.xip (ID = 114354)
3:16 PM: d_icons_buttons_bbar8.xip (ID = 114356)
3:16 PM: d_icons_buttons_bbar11.xip (ID = 114340)
3:16 PM: icons2.res (ID = 121846)
3:16 PM: s_icons_buttons.xip (ID = 121868)
3:16 PM: d_icons_buttons_bbar8.xip (ID = 114356)
3:17 PM: d_icons_buttons_bbar11.xip (ID = 114340)
3:17 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:17 PM: t2_bg.res (ID = 121851)
3:17 PM: progress.res (ID = 62367)
3:17 PM: s_icons_buttons.xip (ID = 121868)
3:17 PM: d_icons_buttons_bbar11.xip (ID = 114340)
3:17 PM: t2_bg.res (ID = 121851)
3:17 PM: t2_bg.xip (ID = 121869)
3:17 PM: tsd_bg.res (ID = 62382)
3:17 PM: tsd_bg.xip (ID = 62383)
3:17 PM: t2_bg.res (ID = 121851)
3:17 PM: d_icons_buttons_bbar12.xip (ID = 114375)
3:17 PM: icons2.xip (ID = 121862)
3:17 PM: s_icons_buttons.res (ID = 121850)
3:17 PM: d_icons_weather.xip (ID = 121860)
3:17 PM: icons2.xip (ID = 121862)
3:17 PM: d_icons_buttons_bbar3.xip (ID = 114342)
3:17 PM: d_icons_buttons_bbar4.xip (ID = 114355)
3:17 PM: d_icons_buttons_bbar5.xip (ID = 114376)
3:17 PM: d_icons_buttons_bbar6.xip (ID = 114394)
3:17 PM: d_icons_buttons_bbar7.xip (ID = 114343)
3:17 PM: d_icons_buttons_bbar9.xip (ID = 114377)
3:17 PM: d_icons_buttons_bbar3.xip (ID = 114342)
3:17 PM: d_icons_buttons_bbar4.xip (ID = 114355)
3:17 PM: d_icons_buttons_bbar5.xip (ID = 114376)
3:17 PM: d_icons_buttons_bbar6.xip (ID = 114394)
3:17 PM: d_icons_buttons_bbar7.xip (ID = 114343)
3:17 PM: d_icons_buttons_bbar9.xip (ID = 114377)
3:17 PM: d_icons_buttons_bbar10.xip (ID = 114391)
3:17 PM: d_icons_buttons_bbar12.xip (ID = 114375)
3:17 PM: icons2.xip (ID = 121862)
3:17 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:17 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:17 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:17 PM: d_icons_buttons_bbar10.xip (ID = 114391)
3:18 PM: d_icons_buttons_bbar1.xip (ID = 114354)
3:18 PM: d_icons_buttons_x.res (ID = 121839)
3:18 PM: d_icons_buttons_2000.xip (ID = 62280)
3:18 PM: d_icons_buttons_bbar8.xip (ID = 114356)
3:18 PM: d_icons_buttons_x.res (ID = 121839)
3:18 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:18 PM: d_icons_weather.res (ID = 121840)
3:18 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:18 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:18 PM: progress.res (ID = 62367)
3:18 PM: Found Adware: surf accuracy
3:18 PM: ff0aff57-49bc-4e5e-9263-f1dfd4 (ID = 115677)
3:18 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:19 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:19 PM: d_icons_buttons_bbar6.xip (ID = 114394)
3:19 PM: d_icons_buttons_bbar2.xip (ID = 114393)
3:19 PM: s_icons_buttons.xip (ID = 121868)
3:19 PM: t2_bg.xip (ID = 121869)
3:19 PM: tsd_bg.xip (ID = 62383)
3:19 PM: d_icons_weather.xip (ID = 121860)
3:19 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:19 PM: progress.res (ID = 62367)
3:19 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:19 PM: progress.res (ID = 62367)
3:19 PM: t2_bg.res (ID = 121851)
3:19 PM: tsd_bg.res (ID = 62382)
3:19 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:19 PM: default_hotbarcom.mnu (ID = 121820)
3:19 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:19 PM: default_hotbarcom.mnu (ID = 121820)
3:20 PM: d_icons_buttons_bbar2.xip (ID = 114393)
3:20 PM: default_hotbarcom.mnu (ID = 121820)
3:20 PM: default_hotbarcom.mnu (ID = 121820)
3:20 PM: d_icons_weather.res (ID = 121840)
3:20 PM: d_icons_buttons_2000.xip (ID = 62280)
3:20 PM: d_icons_buttons_bbar12.xip (ID = 114375)
3:20 PM: d_icons_buttons_x.res (ID = 121839)
3:20 PM: d_icons_buttons_x.res (ID = 121839)
3:20 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:20 PM: s_icons_buttons.res (ID = 121850)
3:20 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:20 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:20 PM: d_icons_buttons_bbar2.xip (ID = 114393)
3:21 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:21 PM: Found Adware: whenu searchbar/pricebandit
3:21 PM: cf208477-3e78-47ad-8562-e22f3f (ID = 129770)
3:21 PM: 3b9daaec-b31b-44e4-b45d-c76899 (ID = 129805)
3:21 PM: 6f9339cd-c99f-42b8-8b52-67586b (ID = 161460)
3:21 PM: 8425fe18-39b2-4c77-ba62-6ddb9f (ID = 129801)
3:21 PM: 7a57725b-664c-4582-a3d4-035a24 (ID = 129799)
3:21 PM: d_icons_buttons_bbar10.xip (ID = 114391)
3:21 PM: s_icons_buttons.res (ID = 121850)
3:21 PM: default_hotbarcom.mnu (ID = 121820)
3:21 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:21 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:21 PM: hotbar.log (ID = 62345)
3:21 PM: d_icons_buttons_bbar1.xip (ID = 114354)
3:21 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:21 PM: Found Adware: isearch toolbar
3:21 PM: delprot.ini (ID = 64354)
3:21 PM: tsd_bg.res (ID = 62382)
3:21 PM: swpstart.exe (ID = 74759)
3:21 PM: progress.res (ID = 62367)
3:21 PM: top7.cdf (ID = 121853)
3:21 PM: progress.res (ID = 62367)
3:21 PM: progress.res (ID = 62367)
3:21 PM: tsd_bg.res (ID = 62382)
3:21 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:21 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:22 PM: progress.res (ID = 62367)
3:22 PM: progress.res (ID = 62367)
3:22 PM: tsd_bg.res (ID = 62382)
3:22 PM: d_icons_buttons_bbar2.xip (ID = 114393)
3:22 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:22 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:22 PM: t2_bg.res (ID = 121851)
3:22 PM: progress.res (ID = 62367)
3:22 PM: d_icons_buttons_bbar11.xip (ID = 114340)
3:22 PM: d_icons_buttons_3000.xip (ID = 62282)
3:22 PM: d_icons_buttons_x.xip (ID = 121859)
3:22 PM: default_hotbarcom.mnu (ID = 121820)
3:22 PM: d_icons_buttons_x.res (ID = 121839)
3:22 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:22 PM: icons2.res (ID = 121846)
3:22 PM: d_icons_buttons_3000.xip (ID = 62282)
3:22 PM: d_icons_buttons_x.xip (ID = 121859)
3:22 PM: progress.res (ID = 62367)
3:22 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:22 PM: t2_bg.res (ID = 121851)
3:22 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:22 PM: components.cdf (ID = 121817)
3:22 PM: icons2.res (ID = 121846)
3:22 PM: d_icons_weather.res (ID = 121840)
3:22 PM: t2_bg.res (ID = 121851)
3:22 PM: s_icons_buttons.res (ID = 121850)
3:22 PM: d_icons_buttons_3000.xip (ID = 62282)
3:22 PM: d_icons_buttons_x.xip (ID = 121859)
3:22 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:22 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:23 PM: d_icons_weather.res (ID = 121840)
3:23 PM: s_icons_buttons.res (ID = 121850)
3:23 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:23 PM: Found Adware: webrebates
3:23 PM: imgconv.dll (ID = 83909)
3:23 PM: d_icons_weather.res (ID = 121840)
3:23 PM: s_icons_buttons.res (ID = 121850)
3:23 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:23 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:23 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:23 PM: d_icons_weather.xip (ID = 121860)
3:23 PM: tsd_bg.res (ID = 62382)
3:23 PM: icons2.res (ID = 121846)
3:23 PM: icons2.res (ID = 121846)
3:23 PM: theweb.mnu (ID = 121852)
3:23 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:23 PM: t2_bg.xip (ID = 121869)
3:23 PM: tsd_bg.xip (ID = 62383)
3:23 PM: progress.res (ID = 62367)
3:23 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:23 PM: icons2.res (ID = 121846)
3:23 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:23 PM: d_icons_weather.res (ID = 121840)
3:23 PM: icons2.res (ID = 121846)
3:23 PM: d_icons_buttons_bbar4.xip (ID = 114355)
3:23 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:23 PM: d_icons_weather.res (ID = 121840)
3:23 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:23 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:23 PM: d_icons_buttons_bbar10.xip (ID = 114391)
3:23 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:23 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:23 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:23 PM: s_icons_buttons.xip (ID = 121868)
3:24 PM: s_icons_buttons.res (ID = 121850)
3:24 PM: default.xip (ID = 121858)
3:24 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:24 PM: icons2.xip (ID = 121862)
3:24 PM: d_icons_buttons_3000.xip (ID = 62282)
3:24 PM: d_icons_buttons_x.xip (ID = 121859)
3:24 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:24 PM: components.cdf (ID = 121817)
3:24 PM: d_icons_weather.xip (ID = 121860)
3:24 PM: tsd_bg.xip (ID = 62383)
3:24 PM: tsd_bg.res (ID = 62382)
3:24 PM: d_icons_buttons_x.res (ID = 121839)
3:24 PM: default.cdf (ID = 121819)
3:24 PM: d_icons_buttons_x.xip (ID = 121859)
3:24 PM: d_icons_buttons_3000.xip (ID = 62282)
3:24 PM: t2_bg.xip (ID = 121869)
3:24 PM: top7.xip (ID = 114400)
3:24 PM: t2_bg.res (ID = 121851)
3:24 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:24 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:24 PM: d_icons_buttons_bbar7.xip (ID = 114343)
3:24 PM: d_icons_buttons_bbar2.xip (ID = 114393)
3:24 PM: s_icons_buttons.xip (ID = 121868)
3:24 PM: top7_theweb.mnu (ID = 121854)
3:24 PM: t2_bg.xip (ID = 121869)
3:24 PM: progress.res (ID = 62367)
3:24 PM: d_icons_buttons_bbar1.xip (ID = 114354)
3:24 PM: d_icons_buttons_bbar3.xip (ID = 114342)
3:24 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:24 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:24 PM: d_icons_buttons_bbar12.xip (ID = 114375)
3:24 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:24 PM: default.xip (ID = 121858)
3:24 PM: d_icons_buttons_bbar5.xip (ID = 114376)
3:24 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:24 PM: country.xip (ID = 121857)
3:24 PM: d_icons_buttons_bbar3.xip (ID = 114342)
3:25 PM: d_icons_buttons_bbar5.xip (ID = 114376)
3:25 PM: d_icons_buttons_bbar6.xip (ID = 114394)
3:25 PM: d_icons_buttons_bbar8.xip (ID = 114356)
3:25 PM: d_icons_buttons_bbar9.xip (ID = 114377)
3:25 PM: default.cdf (ID = 121819)
3:25 PM: d_icons_buttons_bbar10.xip (ID = 114391)
3:25 PM: d_icons_buttons_bbar4.xip (ID = 114355)
3:25 PM: d_icons_buttons_bbar12.xip (ID = 114375)
3:25 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:25 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:25 PM: layout.xip (ID = 121865)
3:25 PM: layout.cdf (ID = 121848)
3:25 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:25 PM: d_icons_buttons_bbar11.xip (ID = 114340)
3:25 PM: d_icons_buttons_bbar1.xip (ID = 114354)
3:25 PM: d_icons_buttons_bbar1.res (ID = 121825)
3:25 PM: d_icons_buttons_bbar9.xip (ID = 114377)
3:25 PM: progress.res (ID = 62367)
3:25 PM: icons2.xip (ID = 121862)
3:25 PM: d_icons_buttons_2000.xip (ID = 62280)
3:25 PM: d_icons_buttons_bbar7.xip (ID = 114343)
3:25 PM: d_icons_buttons_bbar8.xip (ID = 114356)
3:25 PM: default_hotbarcom.mnu (ID = 121820)
3:25 PM: keywords.xip (ID = 121863)
3:25 PM: d_icons_buttons_bbar4.res (ID = 121833)
3:25 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:25 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:25 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:25 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:25 PM: layout.xip (ID = 121865)
3:25 PM: layout.cdf (ID = 121848)
3:25 PM: tsd_bg.xip (ID = 62383)
3:25 PM: tsd_bg.res (ID = 62382)
3:25 PM: theweb.mnu (ID = 121852)
3:25 PM: top7.cdf (ID = 121853)
3:25 PM: icons2.res (ID = 121846)
3:25 PM: d_icons_weather.xip (ID = 121860)
3:25 PM: d_icons_buttons_x.res (ID = 121839)
3:25 PM: d_icons_buttons_2000.res (ID = 62279)
3:25 PM: top7.xip (ID = 114400)
3:25 PM: default_hotbarcom.mnu (ID = 121820)
3:25 PM: country.xip (ID = 121857)
3:25 PM: keywords.xip (ID = 121863)
3:25 PM: keywords1.xip (ID = 121864)
3:25 PM: keywords1.xip (ID = 121864)
3:25 PM: a0044385.exe (ID = 62324)
3:25 PM: d_icons_buttons_2000.res (ID = 62279)
3:25 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:25 PM: d_icons_buttons_bbar8.res (ID = 121837)
3:26 PM: country.exe (ID = 121818)
3:26 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:26 PM: s_icons_buttons.res (ID = 121850)
3:26 PM: d_icons_weather.res (ID = 121840)
3:26 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:26 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:26 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:26 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:26 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:26 PM: d_icons_buttons_3000.res (ID = 62281)
3:26 PM: country.exe (ID = 121818)
3:26 PM: d_icons_buttons_bbar11.res (ID = 121827)
3:26 PM: d_icons_buttons_3000.res (ID = 62281)
3:26 PM: cspirijl.exe (ID = 62332)
3:26 PM: class-barrel (ID = 78229)
3:26 PM: 4f75ae51-e26a-41d7-9da8-0680cf (ID = 162775)
3:27 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:27 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:27 PM: keywords.idx (ID = 121847)
3:27 PM: keywords.idx (ID = 121847)
3:27 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:27 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:27 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:27 PM: d_icons_buttons_bbar9.res (ID = 121838)
3:27 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:27 PM: d_icons_buttons_2000.xip (ID = 62280)
3:27 PM: vocabulary (ID = 78283)
3:27 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:27 PM: d_icons_buttons_bbar6.res (ID = 121835)
3:27 PM: d_icons_buttons_2000.xip (ID = 62280)
3:27 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:28 PM: d_icons_buttons_bbar5.res (ID = 121834)
3:28 PM: top7_theweb.mnu (ID = 121854)
3:28 PM: d_icons_buttons_bbar7.res (ID = 121836)
3:28 PM: d_icons_buttons_bbar3.res (ID = 121832)
3:28 PM: d_icons_buttons_bbar12.res (ID = 121828)
3:28 PM: d_icons_buttons_x.res (ID = 121839)
3:29 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:29 PM: d_icons_buttons_bbar10.res (ID = 121826)
3:29 PM: d_icons_buttons_3000.res (ID = 62281)
3:29 PM: d_icons_buttons_2000.res (ID = 62279)
3:30 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:30 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:30 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:30 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:30 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:30 PM: d_icons_buttons_bbar2.res (ID = 121831)
3:30 PM: d_icons_buttons_2000.res (ID = 62279)
3:30 PM: d_icons_buttons_2000.res (ID = 62279)
3:30 PM: d_icons_buttons_2000.res (ID = 62279)
3:30 PM: d_icons_buttons_2000.res (ID = 62279)
3:30 PM: d_icons_buttons_3000.res (ID = 62281)
3:30 PM: d_icons_buttons_2000.res (ID = 62279)
3:30 PM: d_icons_buttons_3000.res (ID = 62281)
3:30 PM: d_icons_buttons_3000.res (ID = 62281)
3:30 PM: d_icons_buttons_3000.res (ID = 62281)
3:31 PM: d_icons_buttons_3000.res (ID = 62281)
3:33 PM: 113_dollarrevenue_4_0_3_9.exe (ID = 166444)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: hotbar_promo.xip (ID = 114346)
3:34 PM: a9995f69-54a1-4c6d-99ad-7947ae.asq (ID = 62333)
3:34 PM: linkpathlegal.xip (ID = 121866)
3:34 PM: linkpathlegal.txt (ID = 121849)
3:34 PM: d_icons_buttons_logos.xip (ID = 62296)
3:34 PM: d_icons_buttons_logos.res (ID = 62283)
3:34 PM: d_icons_buttons_other.xip (ID = 62296)
3:34 PM: d_icons_buttons_other.res (ID = 62283)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: d_icons_buttons_bar.xip (ID = 62296)
3:34 PM: d_icons_buttons_bar.res (ID = 62283)
3:34 PM: d_icons_buttons_bbar13.xip (ID = 114341)
3:34 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:34 PM: d_icons_buttons_bbar14.xip (ID = 114341)
3:34 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:34 PM: business_promo.xip (ID = 121856)
3:34 PM: hotbar_promo.xip (ID = 114346)
3:34 PM: default_mails.mnu (ID = 121821)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: email-def-511724-548964.mnu (ID = 121841)
3:34 PM: ads.xip (ID = 121855)
3:34 PM: ads.cdf (ID = 121815)
3:34 PM: hotbar-premium.xip (ID = 114359)
3:34 PM: hotbar-premium.cdf (ID = 121845)
3:34 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:34 PM: email-def-email-backgrounds.mnu (ID = 121844)
3:34 PM: email-premium-email-premium.mnu (ID = 121844)
3:34 PM: email-premium-email-premium_oi.mnu (ID = 121844)
3:34 PM: email-def-511745-514279.mnu (ID = 121844)
3:34 PM: business_promo.xip (ID = 121856)
3:34 PM: linkpathlegal.xip (ID = 121866)
3:34 PM: d_icons_buttons_logos.xip (ID = 62296)
3:34 PM: d_icons_buttons_other.xip (ID = 62296)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: d_icons_buttons_bar.xip (ID = 62296)
3:34 PM: d_icons_buttons_bbar13.xip (ID = 114341)
3:34 PM: d_icons_buttons_bbar14.xip (ID = 114341)
3:34 PM: business_promo.xip (ID = 121856)
3:34 PM: ads.xip (ID = 121855)
3:34 PM: hotbar-premium.xip (ID = 114359)
3:34 PM: linkpathlegal.xip (ID = 121866)
3:34 PM: d_icons_buttons_logos.xip (ID = 62296)
3:34 PM: d_icons_buttons_other.xip (ID = 62296)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: d_icons_buttons_bar.xip (ID = 62296)
3:34 PM: d_icons_buttons_bbar13.xip (ID = 114341)
3:34 PM: d_icons_buttons_bbar14.xip (ID = 114341)
3:34 PM: business_promo.xip (ID = 121856)
3:34 PM: linkpathlegal.txt (ID = 121849)
3:34 PM: ads.xip (ID = 121855)
3:34 PM: hotbar-premium.xip (ID = 114359)
3:34 PM: linkpathlegal.txt (ID = 121849)
3:34 PM: d_icons_buttons_logos.res (ID = 62283)
3:34 PM: d_icons_buttons_other.res (ID = 62283)
3:34 PM: d_icons_buttons_bar.res (ID = 62283)
3:34 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:34 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:34 PM: default_mails.mnu (ID = 121821)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: ads.cdf (ID = 121815)
3:34 PM: hotbar-premium.cdf (ID = 121845)
3:34 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:34 PM: d_icons_buttons_logos.res (ID = 62283)
3:34 PM: d_icons_buttons_other.res (ID = 62283)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: d_icons_buttons_bar.res (ID = 62283)
3:34 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:34 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:34 PM: default_mails.mnu (ID = 121821)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: ads.cdf (ID = 121815)
3:34 PM: hotbar-premium.cdf (ID = 121845)
3:34 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:34 PM: email-def-email-backgrounds.mnu (ID = 121844)
3:34 PM: email-premium-email-premium.mnu (ID = 121844)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: email-def-511745-514279.mnu (ID = 121844)
3:34 PM: email-def-511724-9696.mnu (ID = 121842)
3:34 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:34 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:34 PM: linkpathlegal.xip (ID = 121866)
3:34 PM: linkpathlegal.txt (ID = 121849)
3:34 PM: d_icons_buttons_logos.xip (ID = 62296)
3:34 PM: d_icons_buttons_logos.res (ID = 62283)
3:34 PM: d_icons_buttons_other.xip (ID = 62296)
3:34 PM: d_icons_buttons_other.res (ID = 62283)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: d_icons_buttons_bar.xip (ID = 62296)
3:34 PM: d_icons_buttons_bar.res (ID = 62283)
3:34 PM: d_icons_buttons_bbar13.xip (ID = 114341)
3:34 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:34 PM: d_icons_buttons_bbar14.xip (ID = 114341)
3:34 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:34 PM: business_promo.xip (ID = 121856)
3:34 PM: default_mails.mnu (ID = 121821)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: ads.xip (ID = 121855)
3:34 PM: ads.cdf (ID = 121815)
3:34 PM: hotbar-premium.xip (ID = 114359)
3:34 PM: hotbar-premium.cdf (ID = 121845)
3:34 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:34 PM: email-def-email-backgrounds.mnu (ID = 121844)
3:34 PM: email-premium-email-premium.mnu (ID = 121844)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: email-def-511745-514279.mnu (ID = 121844)
3:34 PM: email-def-511724-9696.mnu (ID = 121842)
3:34 PM: linkpathlegal.txt (ID = 121849)
3:34 PM: d_icons_buttons_logos.res (ID = 62283)
3:34 PM: d_icons_buttons_other.res (ID = 62283)
3:34 PM: d_icons_buttons_bar.res (ID = 62283)
3:34 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:34 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:34 PM: default_mails.mnu (ID = 121821)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: ads.cdf (ID = 121815)
3:34 PM: hotbar-premium.cdf (ID = 121845)
3:34 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:34 PM: progress.xip (ID = 62368)
3:34 PM: email-def-email-backgrounds.mnu (ID = 121844)
3:34 PM: email-premium-email-premium.mnu (ID = 121844)
3:34 PM: email-def-511724-9595.mnu (ID = 121842)
3:34 PM: email-def-511745-514279.mnu (ID = 121844)
3:34 PM: email-def-511724-9696.mnu (ID = 121842)
3:35 PM: linkpathlegal.xip (ID = 121866)
3:35 PM: linkpathlegal.txt (ID = 121849)
3:35 PM: d_icons_buttons_logos.xip (ID = 62296)
3:35 PM: d_icons_buttons_logos.res (ID = 62283)
3:35 PM: d_icons_buttons_other.xip (ID = 62296)
3:35 PM: d_icons_buttons_other.res (ID = 62283)
3:35 PM: progress.xip (ID = 62368)
3:35 PM: d_icons_buttons_bar.xip (ID = 62296)
3:35 PM: d_icons_buttons_bar.res (ID = 62283)
3:35 PM: d_icons_buttons_bbar13.xip (ID = 114341)
3:35 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:35 PM: d_icons_buttons_bbar14.xip (ID = 114341)
3:35 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:35 PM: business_promo.xip (ID = 121856)
3:35 PM: hotbar_promo.xip (ID = 114346)
3:35 PM: default_mails.mnu (ID = 121821)
3:35 PM: email-def-511724-9595.mnu (ID = 121842)
3:35 PM: email-def-511724-548964.mnu (ID = 121841)
3:35 PM: ads.xip (ID = 121855)
3:35 PM: ads.cdf (ID = 121815)
3:35 PM: hotbar-premium.xip (ID = 114359)
3:35 PM: hotbar-premium.cdf (ID = 121845)
3:35 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:35 PM: linkpathlegal.txt (ID = 121849)
3:35 PM: d_icons_buttons_logos.res (ID = 62283)
3:35 PM: d_icons_buttons_other.res (ID = 62283)
3:35 PM: d_icons_buttons_bar.res (ID = 62283)
3:35 PM: d_icons_buttons_bbar13.res (ID = 121829)
3:35 PM: d_icons_buttons_bbar14.res (ID = 121829)
3:35 PM: default_mails.mnu (ID = 121821)
3:35 PM: email-def-511724-9595.mnu (ID = 121842)
3:35 PM: ads.cdf (ID = 121815)
3:35 PM: hotbar-premium.cdf (ID = 121845)
3:35 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:35 PM: linkpathlegal.txt (ID = 121849)
3:35 PM: d_icons_buttons_logos.res (ID = 62283)
3:35 PM: d_icons_buttons_other.res (ID = 62283)
3:35 PM: d_icons_buttons_bar.res (ID = 62283)
3:35 PM: default_mails.mnu (ID = 121821)
3:35 PM: email-def-511724-9595.mnu (ID = 121842)
3:35 PM: ads.cdf (ID = 121815)
3:35 PM: hotbar-premium.cdf (ID = 121845)
3:35 PM: hotbar-premium-hotbar-premium.mnu (ID = 121844)
3:35 PM: email-def-email-backgrounds.mnu (ID = 121844)
3:35 PM: email-premium-email-premium.mnu (ID = 121844)
3:35 PM: email-premium-email-premium_oi.mnu (ID = 121844)
3:35 PM: email-def-511745-514279.mnu (ID = 121844)
3:35 PM: 0b263854-f2cd-4e67-98ef-de63ae.asq (ID = 74756)
3:35 PM: Found Adware: effective-i toolbar
3:35 PM: 12c440b3-bdb4-47d8-86ed-73b25a (ID = 59855)
3:35 PM: d757f8cb-c959-4e1c-937e-c8d377 (ID = 59838)
3:35 PM: Found Adware: isearch desktop search
3:35 PM: a0063248.ini (ID = 64321)
3:35 PM: 462a2b60-cca5-4846-823e-57dbe1.asq (ID = 74756)
3:35 PM: bc748f45-8bf9-46b2-a871-12fa9b (ID = 161463)
3:35 PM: e41ad04c-29e0-4036-a6e8-16e5e6.asq (ID = 74756)
3:35 PM: Found System Monitor: potentially rootkit-masked files
3:35 PM: 05.jpg (ID = 0)
3:35 PM: pornication.com.url (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: zbthumbnail.info (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: 24.jpg (ID = 0)
3:35 PM: dl.bak (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: 6.mpeg (ID = 0)
3:35 PM: 64.jpg (ID = 0)
3:35 PM: 0238_04_tgp2.wmv (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: sysfile.dat (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: 08.jpg (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: teen13.jpg (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: datamap.idx (ID = 0)
3:35 PM: datamap.dat (ID = 0)
3:35 PM: user.idx (ID = 0)
3:35 PM: user.dat (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: zbthumbnail.info (ID = 0)
3:35 PM: 01.jpg (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: zbthumbnail.info (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: 13.jpg (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:35 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: filepar.spf (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: dirlist (ID = 0)
3:36 PM: attwgdi.dll (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: atwcheck.exe (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: gswdll.dll (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: 10.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: attwlib.dll (ID = 0)
3:36 PM: 01aaa.jpg (ID = 0)
3:36 PM: 9.mpeg (ID = 0)
3:36 PM: atrw0460.rpw (ID = 0)
3:36 PM: teen4.jpg (ID = 0)
3:36 PM: teen9n.jpg (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: credit.hlc (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: menu0005.hlp (ID = 0)
3:36 PM: credit.spf (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: tfrbsa (ID = 0)
3:36 PM: proforma.spf (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: standord.spf (ID = 0)
3:36 PM: credit.spf (ID = 0)
3:36 PM: invoice.spf (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: prodprce.dat (ID = 0)
3:36 PM: 0818_016b.jpg (ID = 0)
3:36 PM: 04.jpg (ID = 0)
3:36 PM: supprmt3.idx (ID = 0)
3:36 PM: supprnpr.dat (ID = 0)
3:36 PM: 05.jpg (ID = 0)
3:36 PM: 06.jpg (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 0818_017.jpg (ID = 0)
3:36 PM: 009.jpg (ID = 0)
3:36 PM: 03.jpg (ID = 0)
3:36 PM: {master}.inv (ID = 0)
3:36 PM: 02.jpg (ID = 0)
3:36 PM: supprncv.dat (ID = 0)
3:36 PM: prntfile.rpt (ID = 0)
3:36 PM: prefprod.spf (ID = 0)
3:36 PM: attbpdt.dll (ID = 0)
3:36 PM: barcdlog.txt (ID = 0)
3:36 PM: supprms1.idx (ID = 0)
3:36 PM: supprnpr.idx (ID = 0)
3:36 PM: podtl.idx (ID = 0)
3:36 PM: pohdr.dat (ID = 0)
3:36 PM: prodasup.dat (ID = 0)
3:36 PM: salmst01.idx (ID = 0)
3:36 PM: leavetrn.idx (ID = 0)
3:36 PM: overtime.dat (ID = 0)
3:36 PM: overtime.idx (ID = 0)
3:36 PM: payrgl.dat (ID = 0)
3:36 PM: payrgl.idx (ID = 0)
3:36 PM: aix633.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: e20030-b.jpg (ID = 0)
3:36 PM: prodasup.idxx (ID = 0)
3:36 PM: austax.spf (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: am8910.jpg (ID = 0)
3:36 PM: 10m148.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: google image result for shempland.com-sept03-0929thumb15.jpg.url (ID = 0)
3:36 PM: google image result for www.atlantits.com-images-daily-2003-august-14-jules.jpg.url (ID = 0)
3:36 PM: invoice.spf (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: order.spf (ID = 0)
3:36 PM: 986beigea.jpg (ID = 0)
3:36 PM: 16-544.jpg (ID = 0)
3:36 PM: p01-back.jpg (ID = 0)
3:36 PM: p03-leather-back.jpg (ID = 0)
3:36 PM: p03-leather-wine.jpg (ID = 0)
3:36 PM: 77-544.jpg (ID = 0)
3:36 PM: l461.jpg (ID = 0)
3:36 PM: quote.spf (ID = 0)
3:36 PM: l583.jpg (ID = 0)
3:36 PM: google image result for www.slickbikini.com-mainpage-ariafull.jpg ....good ashley.url (ID = 0)
3:36 PM: google image result for www.threewisheslingerie.com-lycrahotpants-l.jpg.url (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 74-544.jpg (ID = 0)
3:36 PM: l251.jpg (ID = 0)
3:36 PM: p03-white.jpg (ID = 0)
3:36 PM: 2.jpg (ID = 0)
3:36 PM: alex.qot (ID = 0)
3:36 PM: teen01.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: menu0022.hlp (ID = 0)
3:36 PM: menu0029.hlp (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: y431g.jpg (ID = 0)
3:36 PM: barcode.inv (ID = 0)
3:36 PM: a-d47-red.jpg (ID = 0)
3:36 PM: p04-leather-back.jpg (ID = 0)
3:36 PM: f1529+.jpg (ID = 0)
3:36 PM: a-d50-suede-back.jpg (ID = 0)
3:36 PM: bpay.inv (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: v-084-bianca.jpg (ID = 0)
3:36 PM: v-092c-lady-corset.jpg (ID = 0)
3:36 PM: 13.jpg (ID = 0)
3:36 PM: 10.jpg (ID = 0)
3:36 PM: t5350.jpg (ID = 0)
3:36 PM: 09.jpg (ID = 0)
3:36 PM: 08.jpg (ID = 0)
3:36 PM: 07.jpg (ID = 0)
3:36 PM: 2.jpg (ID = 0)
3:36 PM: 001523.jpg (ID = 0)
3:36 PM: 001504.jpg (ID = 0)
3:36 PM: v-125cw.jpg (ID = 0)
3:36 PM: 0006.jpg (ID = 0)
3:36 PM: 15.jpg (ID = 0)
3:36 PM: 014.jpg (ID = 0)
3:36 PM: 012.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 05.jpg (ID = 0)
3:36 PM: 011.jpg (ID = 0)
3:36 PM: zbthumbnail.info (ID = 0)
3:36 PM: beauty.url (ID = 0)
3:36 PM: 010.jpg (ID = 0)
3:36 PM: f1635+.jpg (ID = 0)
3:36 PM: p04-leather.jpg (ID = 0)
3:36 PM: 0009.jpg (ID = 0)
3:36 PM: 16.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 011.jpg (ID = 0)
3:36 PM: picture%20108.jpg (ID = 0)
3:36 PM: 016.jpg (ID = 0)
3:36 PM: 16.jpg (ID = 0)
3:36 PM: 13.jpg (ID = 0)
3:36 PM: 04.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: sample03.jpg (ID = 0)
3:36 PM: 04.wmv (ID = 0)
3:36 PM: 017.jpg (ID = 0)
3:36 PM: quote001.qot (ID = 0)
3:36 PM: 004.jpg (ID = 0)
3:36 PM: supprncv.idx (ID = 0)
3:36 PM: suppschg.dat (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: p05-back.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: menu0009.hlp (ID = 0)
3:36 PM: 01.jpg (ID = 0)
3:36 PM: jap261x022.jpg (ID = 0)
3:36 PM: jap261x016.jpg (ID = 0)
3:36 PM: prodmast.idx (ID = 0)
3:36 PM: newwface.pra (ID = 0)
3:36 PM: barcode.cra (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: altfdr20white.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 005.jpg (ID = 0)
3:36 PM: 013.jpg (ID = 0)
3:36 PM: v-085f.jpg (ID = 0)
3:36 PM: 003.jpg (ID = 0)
3:36 PM: 01.jpg (ID = 0)
3:36 PM: 004.jpg (ID = 0)
3:36 PM: f1580+.jpg (ID = 0)
3:36 PM: v-092c-lady.jpg (ID = 0)
3:36 PM: 001486.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 48.jpg (ID = 0)
3:36 PM: 001485.jpg (ID = 0)
3:36 PM: v-125cw-2.jpg (ID = 0)
3:36 PM: v-832k-sleeping-corselette.jpg (ID = 0)
3:36 PM: 007.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: cpy.exe (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 58.jpg (ID = 0)
3:36 PM: 011.jpg (ID = 0)
3:36 PM: 012.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 0040.mpeg (ID = 0)
3:36 PM: 3.mpeg (ID = 0)
3:36 PM: 402.mpeg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 05.wmv (ID = 0)
3:36 PM: 013.jpg (ID = 0)
3:36 PM: 0818_037.jpg (ID = 0)
3:36 PM: prodasup.datx (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 6.jpg (ID = 0)
3:36 PM: 1.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 12.jpg (ID = 0)
3:36 PM: 56.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 2.jpg (ID = 0)
3:36 PM: 3a.jpg (ID = 0)
3:36 PM: lb04.jpg (ID = 0)
3:36 PM: pic05.jpg (ID = 0)
3:36 PM: teen08.jpg (ID = 0)
3:36 PM: amateur01.jpg (ID = 0)
3:36 PM: amateur02.jpg (ID = 0)
3:36 PM: img_3978.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: lb13.jpg (ID = 0)
3:36 PM: pic06.jpg (ID = 0)
3:36 PM: picture%20078.jpg (ID = 0)
3:36 PM: lb33.jpg (ID = 0)
3:36 PM: pic08.jpg (ID = 0)
3:36 PM: picture%20079.jpg (ID = 0)
3:36 PM: amateur03.jpg (ID = 0)
3:36 PM: amateur04.jpg (ID = 0)
3:36 PM: i01.jpg (ID = 0)
3:36 PM: lb37.jpg (ID = 0)
3:36 PM: pic10.jpg (ID = 0)
3:36 PM: teen01.jpg (ID = 0)
3:36 PM: amateur05.jpg (ID = 0)
3:36 PM: amateur06.jpg (ID = 0)
3:36 PM: img_3873.jpg (ID = 0)
3:36 PM: amateur07.jpg (ID = 0)
3:36 PM: amateur09.jpg (ID = 0)
3:36 PM: i02.jpg (ID = 0)
3:36 PM: amateur15.jpg (ID = 0)
3:36 PM: hoterica15.jpg (ID = 0)
3:36 PM: alex31.jpg (ID = 0)
3:36 PM: hoterica2.jpg (ID = 0)
3:36 PM: img_3885.jpg (ID = 0)
3:36 PM: 08.jpg (ID = 0)
3:36 PM: 1.jpg (ID = 0)
3:36 PM: 12.jpg (ID = 0)
3:36 PM: sml18.jpg (ID = 0)
3:36 PM: hoterica3.jpg (ID = 0)
3:36 PM: img_3888.jpg (ID = 0)
3:36 PM: img_3963.jpg (ID = 0)
3:36 PM: 11.jpg (ID = 0)
3:36 PM: readme.txt (ID = 0)
3:36 PM: hoterica4.jpg (ID = 0)
3:36 PM: hoterica9.jpg (ID = 0)
3:36 PM: 13.jpg (ID = 0)
3:36 PM: cpnw-corsette_0263.jpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: menu0020.hlp (ID = 0)
3:36 PM: suppchqp.rwo (ID = 0)
CONT>>>

Edited by redghia, 05 November 2005 - 02:11 AM.

[redghia]

3:36 PM: salerp3.rwo (ID = 0)
3:36 PM: {master}.inv (ID = 0)
3:36 PM: salerp2.rwo (ID = 0)
3:36 PM: salerp1.rwo (ID = 0)
3:36 PM: salerp0.rwo (ID = 0)
3:36 PM: salerep1.rwo (ID = 0)
3:36 PM: prodstat.rwo (ID = 0)
3:36 PM: prodlabl.rwo (ID = 0)
3:36 PM: poitemdu.rwo (ID = 0)
3:36 PM: custsma4.rwo (ID = 0)
3:36 PM: suppchqp.rwo (ID = 0)
3:36 PM: suppcas.rwo (ID = 0)
3:36 PM: prodsale.rwo (ID = 0)
3:36 PM: prodlist.rwo (ID = 0)
3:36 PM: suppchqp.rwo (ID = 0)
3:36 PM: suppcas.rwo (ID = 0)
3:36 PM: supppur.rwo (ID = 0)
3:36 PM: supppay.rwo (ID = 0)
3:36 PM: suppcrav.rwo (ID = 0)
3:36 PM: suppchqp.rwo (ID = 0)
3:36 PM: suppcas.rwo (ID = 0)
3:36 PM: salerp1.rwo (ID = 0)
3:36 PM: salerep1.rwo (ID = 0)
3:36 PM: prodstat.rwo (ID = 0)
3:36 PM: prodsale.rwo (ID = 0)
3:36 PM: poitemdu.rwo (ID = 0)
3:36 PM: custsma4.rwo (ID = 0)
3:36 PM: {master}.cra (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: atrw0950.rpw (ID = 0)
3:36 PM: atrw0900.rpw (ID = 0)
3:36 PM: {master}.wra (ID = 0)
3:36 PM: {master}.qot (ID = 0)
3:36 PM: {master}.pck (ID = 0)
3:36 PM: {master}.inv (ID = 0)
3:36 PM: {master}.del (ID = 0)
3:36 PM: {master}.crn (ID = 0)
3:36 PM: {master}.smt (ID = 0)
3:36 PM: atrw0850.rpw (ID = 0)
3:36 PM: atrw0820.rpw (ID = 0)
3:36 PM: atrw0650.rpw (ID = 0)
3:36 PM: atrw0600.rpw (ID = 0)
3:36 PM: atrw0560.rpw (ID = 0)
3:36 PM: atrw0510.rpw (ID = 0)
3:36 PM: atrw0500.rpw (ID = 0)
3:36 PM: atrw0470.rpw (ID = 0)
3:36 PM: atrw0460.rpw (ID = 0)
3:36 PM: atrw0450.rpw (ID = 0)
3:36 PM: atrw0400.rpw (ID = 0)
3:36 PM: atrw0370.rpw (ID = 0)
3:36 PM: atrw0360.rpw (ID = 0)
3:36 PM: atrw0330.rpw (ID = 0)
3:36 PM: atrw0320.rpw (ID = 0)
3:36 PM: atrw0310.rpw (ID = 0)
3:36 PM: atrw0305.rpw (ID = 0)
3:36 PM: atrw0300.rpw (ID = 0)
3:36 PM: atrw0280.rpw (ID = 0)
3:36 PM: atrw0275.rpw (ID = 0)
3:36 PM: atrw0270.rpw (ID = 0)
3:36 PM: atrw0255.rpw (ID = 0)
3:36 PM: atrw0252.rpw (ID = 0)
3:36 PM: atrw0250.rpw (ID = 0)
3:36 PM: atrw0240.rpw (ID = 0)
3:36 PM: atrw0230.rpw (ID = 0)
3:36 PM: atrw0220.rpw (ID = 0)
3:36 PM: atrw0218.rpw (ID = 0)
3:36 PM: atrw0215.rpw (ID = 0)
3:36 PM: atrw0210.rpw (ID = 0)
3:36 PM: atrw0200.rpw (ID = 0)
3:36 PM: atrw0180.rpw (ID = 0)
3:36 PM: atrw0160.rpw (ID = 0)
3:36 PM: atrw0150.rpw (ID = 0)
3:36 PM: atrw0140.rpw (ID = 0)
3:36 PM: atrw0130.rpw (ID = 0)
3:36 PM: atrw0120.rpw (ID = 0)
3:36 PM: atrw0105.rpw (ID = 0)
3:36 PM: atrw0100.rpw (ID = 0)
3:36 PM: atrw0090.rpw (ID = 0)
3:36 PM: atrw0077.rpw (ID = 0)
3:36 PM: atrw0075.rpw (ID = 0)
3:36 PM: atrw0070.rpw (ID = 0)
3:36 PM: atrw0062.rpw (ID = 0)
3:36 PM: atrw0060.rpw (ID = 0)
3:36 PM: atrw0055.rpw (ID = 0)
3:36 PM: atrw0050.rpw (ID = 0)
3:36 PM: atrw0040.rpw (ID = 0)
3:36 PM: atrw0020.rpw (ID = 0)
3:36 PM: requ.spf (ID = 0)
3:36 PM: 017.jpg (ID = 0)
3:36 PM: ja261x003.jpg (ID = 0)
3:36 PM: jap261x006.jpg (ID = 0)
3:36 PM: rfc.spf (ID = 0)
3:36 PM: {master}.sip (ID = 0)
3:36 PM: {master}.scp (ID = 0)
3:36 PM: {master}.rop (ID = 0)
3:36 PM: order.spf (ID = 0)
3:36 PM: {master}.pop (ID = 0)
3:36 PM: kit.spf (ID = 0)
3:36 PM: invoice.spf (ID = 0)
3:36 PM: grn.spf (ID = 0)
3:36 PM: prefprod.spf (ID = 0)
3:36 PM: credit.spf (ID = 0)
3:36 PM: {master}.gtp (ID = 0)
3:36 PM: {master}.grp (ID = 0)
3:36 PM: webdata1.idx (ID = 0)
3:36 PM: webdata1.dat (ID = 0)
3:36 PM: standord.spf (ID = 0)
3:36 PM: quote.spf (ID = 0)
3:36 PM: usermenu.idx (ID = 0)
3:36 PM: usermenu.dat (ID = 0)
3:36 PM: proforma.spf (ID = 0)
3:36 PM: order.spf (ID = 0)
3:36 PM: sysfile.idx (ID = 0)
3:36 PM: sysfile.dat (ID = 0)
3:36 PM: invoice.spf (ID = 0)
3:36 PM: credit.spf (ID = 0)
3:36 PM: suppschg.idx (ID = 0)
3:36 PM: suppschg.dat (ID = 0)
3:36 PM: credit.hlc (ID = 0)
3:36 PM: 005.jpg (ID = 0)
3:36 PM: supprncv.idx (ID = 0)
3:36 PM: 50.jpg (ID = 0)
3:36 PM: supprmt3.idx (ID = 0)
3:36 PM: supprmt3.dat (ID = 0)
3:36 PM: kristin63_13.jpg (ID = 0)
3:36 PM: suppmast.dat (ID = 0)
3:36 PM: 0385_03_tgp2.wmv (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 0020.mpeg (ID = 0)
3:36 PM: 0011.mpg (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: 0030.mpeg (ID = 0)
3:36 PM: 0040.mpeg (ID = 0)
3:36 PM: 01xx.mpeg (ID = 0)
3:36 PM: img_3892.jpg (ID = 0)
3:36 PM: 001.jpg (ID = 0)
3:36 PM: jap261x002.jpg (ID = 0)
3:36 PM: agnvo030.jpg (ID = 0)
3:36 PM: a-d49-brown-suede.jpg (ID = 0)
3:36 PM: ordscrn.pif (ID = 0)
3:36 PM: invscrn.pif (ID = 0)
3:36 PM: pkunzip.exe (ID = 0)
3:36 PM: pkzip.exe (ID = 0)
3:36 PM: glmastly.dat (ID = 0)
3:36 PM: glmast.dat (ID = 0)
3:36 PM: pkzip.exe (ID = 0)
3:36 PM: pkunzip.exe (ID = 0)
3:36 PM: grpname.dat (ID = 0)
3:36 PM: glmastly.idx (ID = 0)
3:36 PM: glmast.idx (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: imp (ID = 0)
3:36 PM: custmasx.dat (ID = 0)
3:36 PM: 4.jpg (ID = 0)
3:36 PM: gstfile.dat (ID = 0)
3:36 PM: 1.mpeg (ID = 0)
3:36 PM: crthdr.dat (ID = 0)
3:36 PM: crnscrn.pif (ID = 0)
3:36 PM: {master}.cra (ID = 0)
3:36 PM: barcode.cra (ID = 0)
3:36 PM: {master}.wra (ID = 0)
3:36 PM: visa.wra (ID = 0)
3:36 PM: thumbs.db (ID = 0)
3:36 PM: glmastly.dat (ID = 0)
3:36 PM: glmast.dat (ID = 0)
3:36 PM: custmast.idx (ID = 0)
3:36 PM: mastercd.wra (ID = 0)
3:36 PM: barcode.wra (ID = 0)
3:36 PM: ff3.wmv (ID = 0)
3:36 PM: 0194_03_tgp2.wmv (ID = 0)
3:36 PM: custbank.idx (ID = 0)
3:36 PM: sysfile.dat (ID = 0)
3:36 PM: custdel.idx (ID = 0)
3:36 PM: custbank.dat (ID = 0)
3:36 PM: prodtrn.idx (ID = 0)
3:36 PM: crtdtl.dat (ID = 0)
3:36 PM: 3.jpg (ID = 0)
3:36 PM: custom~1.xml (ID = 0)
3:36 PM: prodmast.idx (ID = 0)
3:36 PM: {master}.pra (ID = 0)
3:36 PM: pohdr.idx (ID = 0)
3:36 PM: windface.pra (ID = 0)
3:36 PM: newwface.pra (ID = 0)
3:36 PM: a4wide.pra (ID = 0)
3:36 PM: sys.hlp (ID = 0)
3:36 PM: a4slim.pra (ID = 0)
3:36 PM: {master}.rfc (ID = 0)
3:36 PM: {master}.req (ID = 0)
3:36 PM: {master}.ord (ID = 0)
3:36 PM: invdtl.idx (ID = 0)
3:36 PM: {master}.inv (ID = 0)
3:36 PM: {master}.grn (ID = 0)
3:36 PM: {master}.crn (ID = 0)
3:36 PM: rcti.inv (ID = 0)
3:36 PM: barcode.rfc (ID = 0)
3:36 PM: {master}.qot (ID = 0)
3:36 PM: {master}.pck (ID = 0)
3:36 PM: {master}.smt (ID = 0)
3:36 PM: {master}.del (ID = 0)
3:36 PM: {master}.crn (ID = 0)
3:36 PM: magic.exe (ID = 0)
3:36 PM: statemnt.smt (ID = 0)
3:36 PM: gstinc.inv (ID = 0)
3:36 PM: requ.spf (ID = 0)
3:36 PM: gstinc.crn (ID = 0)
3:36 PM: kit.spf (ID = 0)
3:36 PM: gstexcl.inv (ID = 0)
3:36 PM: quote001.qot (ID = 0)
3:36 PM: gstexcl.crn (ID = 0)
3:36 PM: form0001.pck (ID = 0)
3:36 PM: v2draw01.dat (ID = 0)
3:36 PM: supptrn2.idx (ID = 0)
3:36 PM: form0001.inv (ID = 0)
3:36 PM: bpay.inv (ID = 0)
3:36 PM: barcode.inv (ID = 0)
3:36 PM: suppmast.dat (ID = 0)
3:36 PM: tb.exe (ID = 0)
3:36 PM: barcode.crn (ID = 0)
3:36 PM: prodtrn.dat (ID = 0)
3:36 PM: man10_pickup_029_300k.wmv (ID = 0)
3:36 PM: alex.qot (ID = 0)
3:36 PM: tearoff.smt (ID = 0)
3:36 PM: staterem.smt (ID = 0)
3:36 PM: rfc.spf (ID = 0)
3:36 PM: podtl.idx (ID = 0)
3:36 PM: order.spf (ID = 0)
3:36 PM: invoice.spf (ID = 0)
3:36 PM: gstaud.dat (ID = 0)
3:36 PM: grn.spf (ID = 0)
3:36 PM: credit.spf (ID = 0)
3:36 PM: glmastly.dat (ID = 0)
3:36 PM: standord.spf (ID = 0)
3:36 PM: prefprod.spf (ID = 0)
3:36 PM: quote.spf (ID = 0)
3:36 PM: proforma.spf (ID = 0)
3:36 PM: order.spf (ID = 0)
3:36 PM: invoice.spf (ID = 0)
3:36 PM: mf.txx (ID = 0)
3:36 PM: credit.spf (ID = 0)
3:36 PM: supptrn2.dat (ID = 0)
3:36 PM: register.dat (ID = 0)
3:36 PM: glmast.idx (ID = 0)
3:36 PM: prodmast.dat (ID = 0)
3:36 PM: custmast.dat (ID = 0)
3:36 PM: pohdr.dat (ID = 0)
3:36 PM: gstfile.dat (ID = 0)
3:36 PM: p02.jpg (ID = 0)
3:36 PM: invhdr.dat (ID = 0)
3:36 PM: cbprfrmd.dat (ID = 0)
3:36 PM: invdtl.dat (ID = 0)
3:36 PM: cbmast.idx (ID = 0)
3:36 PM: podtl.dat (ID = 0)
3:36 PM: bpdraw01.z (ID = 0)
3:36 PM: bankacct.idx (ID = 0)
3:36 PM: teen04.jpg (ID = 0)
3:36 PM: gltran.idx (ID = 0)
3:36 PM: windface.pra (ID = 0)
3:36 PM: 11.jpg (ID = 0)
3:36 PM: newwface.pra (ID = 0)
3:36 PM: custtrn.dat (ID = 0)
3:36 PM: glset.idx (ID = 0)
3:36 PM: glset.dat (ID = 0)
3:36 PM: 4.jpg (ID = 0)
3:36 PM: crtdtl.dat (ID = 0)
3:36 PM: cbprfrm.idx (ID = 0)
3:36 PM: a4wide.pra (ID = 0)
3:36 PM: a4slim.pra (ID = 0)
3:36 PM: supprnpr.idx (ID = 0)
3:36 PM: payrecon.rwo (ID = 0)
3:36 PM: cbprfrm.dat (ID = 0)
3:36 PM: elcondet.dat (ID = 0)
3:36 PM: {master}.pra (ID = 0)
3:36 PM: taxscale.dat (ID = 0)
3:36 PM: glrnd.dat (ID = 0)
3:36 PM: paytax.rwo (ID = 0)
3:36 PM: grpcert.idx (ID = 0)
3:36 PM: payleave.rwo (ID = 0)
3:36 PM: paydednt.rwo (ID = 0)
3:36 PM: payctrbt.rwo (ID = 0)
3:36 PM: supprnpr.dat (ID = 0)
3:36 PM: supprncv.dat (ID = 0)
3:36 PM: suppmasx.idx (ID = 0)
3:36 PM: farso059.jpg (ID = 0)
3:36 PM: glrep.xls (ID = 0)
3:36 PM: {master}.pra (ID = 0)
3:36 PM: windface.pra (ID = 0)
3:36 PM: suppmasx.dat (ID = 0)
3:36 PM: suppmast.idx (ID = 0)
3:36 PM: leavetrn.idx (ID = 0)
3:36 PM: suppeopr.dat (ID = 0)
3:36 PM: emphdr.idx (ID = 0)
3:36 PM: newwface.pra (ID = 0)
3:36 PM: p01.jpg (ID = 0)
3:36 PM: a4wide.pra (ID = 0)
3:36 PM: a4slim.pra (ID = 0)
3:36 PM: position.dat (ID = 0)
3:36 PM: taxscale.dat (ID = 0)
3:36 PM: 02n.jpg (ID = 0)
3:36 PM: suppchq.idx (ID = 0)
3:36 PM: grpcert.idx (ID = 0)
3:36 PM: suppchq.dat (ID = 0)
3:36 PM: vs150130%201.jpg (ID = 0)
3:36 PM: paytax.rwo (ID = 0)
3:36 PM: paysig.rwo (ID = 0)
3:36 PM: payrecon.rwo (ID = 0)
3:37 PM: payinct.rwo (ID = 0)
3:37 PM: {master}.cra (ID = 0)
3:37 PM: bankacct.dat (ID = 0)
3:37 PM: addition.idx (ID = 0)
3:37 PM: leavetrn.idx (ID = 0)
3:37 PM: 5.jpg (ID = 0)
3:37 PM: {master}.chq (ID = 0)
3:37 PM: {master}.chq (ID = 0)
3:37 PM: 8.jpg (ID = 0)
3:37 PM: {master}.wra (ID = 0)
3:37 PM: 15.jpg (ID = 0)
3:37 PM: suppcas.rwo (ID = 0)
3:37 PM: prodsale.rwo (ID = 0)
3:37 PM: salesrep.idx (ID = 0)
3:37 PM: salesrep.dat (ID = 0)
3:37 PM: addition.idx (ID = 0)
3:37 PM: a4wide.pra (ID = 0)
3:37 PM: jennyeuro1.jpg (ID = 0)
3:37 PM: visa.wra (ID = 0)
3:37 PM: employee.dat (ID = 0)
3:37 PM: aix63.jpg (ID = 0)
3:37 PM: tyra02.jpg (ID = 0)
3:37 PM: pic11.jpg (ID = 0)
3:37 PM: teen03.jpg (ID = 0)
3:37 PM: mastercd.wra (ID = 0)
3:37 PM: a4slim.pra (ID = 0)
3:37 PM: employee.dat (ID = 0)
3:37 PM: glmastly.idx (ID = 0)
3:37 PM: barcode.wra (ID = 0)
3:37 PM: 20.jpg (ID = 0)
3:37 PM: prodlabl.idx (ID = 0)
3:37 PM: paygrp.rwo (ID = 0)
3:37 PM: {master}.chq (ID = 0)
3:37 PM: {master}.req (ID = 0)
3:37 PM: 22.jpg (ID = 0)
3:37 PM: emphdr.idx (ID = 0)
3:37 PM: empytd.idx (ID = 0)
3:37 PM: {master}.rfc (ID = 0)
3:37 PM: prodgl.idx (ID = 0)
3:37 PM: prodasup.idx (ID = 0)
3:37 PM: {master}.ord (ID = 0)
3:37 PM: prodasup.dat (ID = 0)
3:37 PM: prodalt.idx (ID = 0)
3:37 PM: prodalt.dat (ID = 0)
3:37 PM: glstdwrt.rwo (ID = 0)
3:37 PM: prodlist.rwo (ID = 0)
3:37 PM: {master}.inv (ID = 0)
3:37 PM: prodgl.dat (ID = 0)
3:37 PM: a-c315-suede.jpg (ID = 0)
3:37 PM: glmast.idx (ID = 0)
3:37 PM: cbmast.dat (ID = 0)
3:37 PM: addition.dat (ID = 0)
3:37 PM: prntfile.rpt (ID = 0)
3:37 PM: supprms1.idx (ID = 0)
3:37 PM: {master}.wra (ID = 0)
3:37 PM: atrw0850.rpw (ID = 0)
3:37 PM: zbthumbnail.info (ID = 0)
3:37 PM: poscrsiv.pif (ID = 0)
3:37 PM: poscrscn.pif (ID = 0)
3:37 PM: poscrreq.pif (ID = 0)
3:37 PM: menu.idx (ID = 0)
3:37 PM: poscrord.pif (ID = 0)
3:37 PM: ali.exe (ID = 0)
3:37 PM: poscrgtn.pif (ID = 0)
3:37 PM: oei.gid (ID = 0)
3:37 PM: kristin56_03.jpg (ID = 0)
3:37 PM: glstd005.rwo (ID = 0)
3:37 PM: glstd004.rwo (ID = 0)
3:37 PM: glstd003.rwo (ID = 0)
3:37 PM: atrw0360.rpw (ID = 0)
3:37 PM: {master}.grn (ID = 0)
3:37 PM: glstd002.rwo (ID = 0)
3:37 PM: glstd001.rwo (ID = 0)
3:37 PM: poscrgrn.pif (ID = 0)
3:37 PM: pohdrx.dat (ID = 0)
3:37 PM: pickprnt.pif (ID = 0)
3:37 PM: {master}.crn (ID = 0)
3:37 PM: menu0057.hlp (ID = 0)
3:37 PM: pickprnt.jt.pif (ID = 0)
3:37 PM: packprnt.pif (ID = 0)
3:37 PM: tend.dll (ID = 0)
3:37 PM: keymessg.idx (ID = 0)
3:37 PM: ordscrn.pif (ID = 0)
3:37 PM: invprnt.pif (ID = 0)
3:37 PM: invprnt.old.pif (ID = 0)
3:37 PM: employee.dat (ID = 0)
3:37 PM: 33.jpg (ID = 0)
3:37 PM: alex41.jpg (ID = 0)
3:37 PM: logfile.idx (ID = 0)
3:37 PM: logfile.dat (ID = 0)
3:37 PM: {master}.inv (ID = 0)
3:37 PM: 7.jpg (ID = 0)
3:37 PM: a-d49-cream-suede.jpg (ID = 0)
3:37 PM: deduct.idx (ID = 0)
3:37 PM: deduct.dat (ID = 0)
3:37 PM: {master}.smt (ID = 0)
3:37 PM: keymessg.dat (ID = 0)
3:37 PM: rcti.inv (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: taxscale.idx (ID = 0)
3:37 PM: glrepwrt.rwo (ID = 0)
3:37 PM: menu0049.hlp (ID = 0)
3:37 PM: barcode.rfc (ID = 0)
3:37 PM: corset.jpg (ID = 0)
3:37 PM: glrep005.rwo (ID = 0)
3:37 PM: glrep004.rwo (ID = 0)
3:37 PM: invscrn.pif (ID = 0)
3:37 PM: crthdr.idx (ID = 0)
3:37 PM: crtdtl.idx (ID = 0)
3:37 PM: {master}.pra (ID = 0)
3:37 PM: menu0048.hlp (ID = 0)
3:37 PM: suplpr.hlp (ID = 0)
3:37 PM: crthdr.dat (ID = 0)
3:37 PM: crtdtl.dat (ID = 0)
3:37 PM: embrace2-big.jpg (ID = 0)
3:37 PM: menu0042.hlp (ID = 0)
3:37 PM: usermenu.idx (ID = 0)
3:37 PM: menu0046.hlp (ID = 0)
3:37 PM: atrw0252.rpw (ID = 0)
3:37 PM: usermenu.dat (ID = 0)
3:37 PM: statemnt.smt (ID = 0)
3:37 PM: menu0019.hlp (ID = 0)
3:37 PM: glrep003.rwo (ID = 0)
3:37 PM: glrep002.rwo (ID = 0)
3:37 PM: glrep001.rwo (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: menu0002.hlp (ID = 0)
3:37 PM: menu0039.hlp (ID = 0)
3:37 PM: menu0036.hlp (ID = 0)
3:37 PM: embrace2a-big.jpg (ID = 0)
3:37 PM: p01-cincher.jpg (ID = 0)
3:37 PM: menu0045.hlp (ID = 0)
3:37 PM: crnscrn.pif (ID = 0)
3:37 PM: menu0043.hlp (ID = 0)
3:37 PM: gstfile.idx (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: sysfile.idx (ID = 0)
3:37 PM: sysfile.dat (ID = 0)
3:37 PM: menu0040.hlp (ID = 0)
3:37 PM: 15.jpg (ID = 0)
3:37 PM: empytd.dat (ID = 0)
3:37 PM: {master}.qot (ID = 0)
3:37 PM: menu0037.hlp (ID = 0)
3:37 PM: menu0035.hlp (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: menu0034.hlp (ID = 0)
3:37 PM: menu0033.hlp (ID = 0)
3:37 PM: menu0030.hlp (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: menu0012.hlp (ID = 0)
3:37 PM: ppoint.idx (ID = 0)
3:37 PM: ppoint.dat (ID = 0)
3:37 PM: p03-blue.jpg (ID = 0)
3:37 PM: position.dat (ID = 0)
3:37 PM: {master}.pck (ID = 0)
3:37 PM: suppchqp.rwo (ID = 0)
3:37 PM: salerp3.rwo (ID = 0)
3:37 PM: salerp2.rwo (ID = 0)
3:37 PM: menu0001.hlp (ID = 0)
3:37 PM: imp (ID = 0)
3:37 PM: menu0028.hlp (ID = 0)
3:37 PM: salerp1.rwo (ID = 0)
3:37 PM: menu0027.hlp (ID = 0)
3:37 PM: {master}.del (ID = 0)
3:37 PM: taxscale.dat (ID = 0)
3:37 PM: salerp0.rwo (ID = 0)
3:37 PM: crnprnt.pif (ID = 0)
3:37 PM: crnprnt.old.pif (ID = 0)
3:37 PM: menu0026.hlp (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: 0005.jpg (ID = 0)
3:37 PM: p05-black-front.jpg (ID = 0)
3:37 PM: menu0025.hlp (ID = 0)
3:37 PM: alex42.jpg (ID = 0)
3:37 PM: suppchqp.rwo (ID = 0)
3:37 PM: leaveacc.idx (ID = 0)
3:37 PM: income.idx (ID = 0)
3:37 PM: income.dat (ID = 0)
3:37 PM: salerep1.rwo (ID = 0)
3:37 PM: prodstat.rwo (ID = 0)
3:37 PM: prodlabl.rwo (ID = 0)
3:37 PM: poitemdu.rwo (ID = 0)
3:37 PM: custsma4.rwo (ID = 0)
3:37 PM: grpname.idx (ID = 0)
3:37 PM: menu0024.hlp (ID = 0)
3:37 PM: grpname.dat (ID = 0)
3:37 PM: menu0013.hlp (ID = 0)
3:37 PM: menu0023.hlp (ID = 0)
3:37 PM: {master}.crn (ID = 0)
3:37 PM: suppcas.rwo (ID = 0)
3:37 PM: leaveacc.dat (ID = 0)
3:37 PM: custmasx.idx (ID = 0)
3:37 PM: atrw0210.rpw (ID = 0)
3:37 PM: suppchqp.rwo (ID = 0)
3:37 PM: p08-back.jpg (ID = 0)
3:37 PM: p08-willow.jpg (ID = 0)
3:37 PM: atbpfrma.spf (ID = 0)
3:37 PM: bankfile.dat (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: atrw0100.rpw (ID = 0)
3:37 PM: custmast.idx (ID = 0)
3:37 PM: custmasx.dat (ID = 0)
3:37 PM: folder.bmp (ID = 0)
3:37 PM: 011.jpg (ID = 0)
3:37 PM: grpcert.idx (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: 14.jpg (ID = 0)
3:37 PM: 5.jpg (ID = 0)
3:37 PM: employee.idx (ID = 0)
3:37 PM: deduct.idx (ID = 0)
3:37 PM: atrw0050.rpw (ID = 0)
3:37 PM: custbank.idx (ID = 0)
3:37 PM: menu0016.hlp (ID = 0)
3:37 PM: print.gid (ID = 0)
3:37 PM: 015.jpg (ID = 0)
3:37 PM: 016.jpg (ID = 0)
3:37 PM: 005.jpg (ID = 0)
3:37 PM: menu0015.hlp (ID = 0)
3:37 PM: gstfile.dat (ID = 0)
3:37 PM: gstinc.inv (ID = 0)
3:37 PM: gstinc.crn (ID = 0)
3:37 PM: deduct.dat (ID = 0)
3:37 PM: menu0004.hlp (ID = 0)
3:37 PM: gstexcl.inv (ID = 0)
3:37 PM: menu0010.hlp (ID = 0)
3:37 PM: gstexcl.crn (ID = 0)
3:37 PM: kfilein.hlp (ID = 0)
3:37 PM: custdel.idx (ID = 0)
3:37 PM: supppur.rwo (ID = 0)
3:37 PM: barcode.crn (ID = 0)
3:37 PM: supppay.rwo (ID = 0)
3:37 PM: suppcrav.rwo (ID = 0)
3:37 PM: custbank.dat (ID = 0)
3:37 PM: suppchqp.rwo (ID = 0)
3:37 PM: suppcas.rwo (ID = 0)
3:37 PM: tearoff.smt (ID = 0)
3:37 PM: payadv.bmp (ID = 0)
3:37 PM: gl.gid (ID = 0)
3:37 PM: suppmast.dat (ID = 0)
3:37 PM: glset.dat (ID = 0)
3:37 PM: salerp1.rwo (ID = 0)
3:37 PM: cust.gid (ID = 0)
3:37 PM: 0818_020b.jpg (ID = 0)
3:37 PM: dscf0041.jpg (ID = 0)
3:37 PM: zbthumbnail.info (ID = 0)
3:37 PM: 4.jpg (ID = 0)
3:37 PM: pohdrx.dat (ID = 0)
3:37 PM: prodgl.dat (ID = 0)
3:37 PM: poscrgrn.pif (ID = 0)
3:37 PM: poscrgtn.pif (ID = 0)
3:37 PM: grpcert.dat (ID = 0)
3:37 PM: salerep1.rwo (ID = 0)
3:37 PM: glnarr.dat (ID = 0)
3:37 PM: staterem.smt (ID = 0)
3:37 PM: a4slim.pra (ID = 0)
3:37 PM: bpayve~1.bmp (ID = 0)
3:37 PM: {master}.req (ID = 0)
3:37 PM: costctr.idx (ID = 0)
3:37 PM: elcondet.idx (ID = 0)
3:37 PM: windface.pra (ID = 0)
3:37 PM: print.hlp (ID = 0)
3:37 PM: {master}.inv (ID = 0)
3:37 PM: contrib.idx (ID = 0)
3:37 PM: newwface.pra (ID = 0)
3:37 PM: custtrn.idx (ID = 0)
3:37 PM: a4wide.pra (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: custmasx.dat (ID = 0)
3:37 PM: a4slim.pra (ID = 0)
3:37 PM: {master}.qot (ID = 0)
3:37 PM: 13.jpg (ID = 0)
3:37 PM: {master}.ord (ID = 0)
3:37 PM: {master}.inv (ID = 0)
3:37 PM: {master}.del (ID = 0)
3:37 PM: menu0047.hlp (ID = 0)
3:37 PM: rcti.inv (ID = 0)
3:37 PM: teen03.jpg (ID = 0)
3:37 PM: be020e.jpg (ID = 0)
3:37 PM: 017.jpg (ID = 0)
3:37 PM: 018.jpg (ID = 0)
3:37 PM: 12.jpg (ID = 0)
3:37 PM: {master}.rfc (ID = 0)
3:37 PM: teen08.jpg (ID = 0)
3:37 PM: vo-1890u.jpg (ID = 0)
3:37 PM: 021.jpg (ID = 0)
3:37 PM: menu0038.hlp (ID = 0)
3:37 PM: {master}.pra (ID = 0)
3:37 PM: taxscale.dat (ID = 0)
3:37 PM: 0818_021.jpg (ID = 0)
3:37 PM: aly09.jpg (ID = 0)
3:37 PM: img7558.jpg (ID = 0)
3:37 PM: dscf0109.jpg (ID = 0)
3:37 PM: contrib.dat (ID = 0)
3:37 PM: bnkdetls.idx (ID = 0)
3:37 PM: bnkdetls.dat (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: rfc.spf (ID = 0)
3:37 PM: 004.jpg (ID = 0)
3:37 PM: {master}.grn (ID = 0)
3:37 PM: barcode.rfc (ID = 0)
3:37 PM: {master}.qot (ID = 0)
3:37 PM: atprt32.dll (ID = 0)
3:37 PM: order.spf (ID = 0)
3:37 PM: {master}.pck (ID = 0)
3:37 PM: {master}.smt (ID = 0)
3:37 PM: 0818_009.jpg (ID = 0)
3:37 PM: nikolinpanties06.jpg (ID = 0)
3:37 PM: 009.jpg (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: {master}.pck (ID = 0)
3:37 PM: invoice.spf (ID = 0)
3:37 PM: custgl.dat (ID = 0)
3:37 PM: crthdr.dat (ID = 0)
3:37 PM: menu0011.hlp (ID = 0)
3:37 PM: quote001.qot (ID = 0)
3:37 PM: 0818_012.jpg (ID = 0)
3:37 PM: dscf0155.jpg (ID = 0)
3:37 PM: {master}.crn (ID = 0)
3:37 PM: 010.jpg (ID = 0)
3:37 PM: 0818_013.jpg (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: grn.spf (ID = 0)
3:37 PM: credit.spf (ID = 0)
3:37 PM: standord.spf (ID = 0)
3:37 PM: costctr.dat (ID = 0)
3:37 PM: 4685.jpg (ID = 0)
3:37 PM: bpay.inv (ID = 0)
3:37 PM: order.spf (ID = 0)
3:37 PM: quote.spf (ID = 0)
3:37 PM: grn.spf (ID = 0)
3:37 PM: atrw0062.rpw (ID = 0)
3:37 PM: requ.spf (ID = 0)
3:37 PM: {master}.inv (ID = 0)
3:37 PM: prodstat.rwo (ID = 0)
3:37 PM: atrw0060.rpw (ID = 0)
3:37 PM: addition.dat (ID = 0)
3:37 PM: proforma.spf (ID = 0)
3:37 PM: {master}.cra (ID = 0)
3:37 PM: quote.spf (ID = 0)
3:37 PM: prefprod.spf (ID = 0)
3:37 PM: barcode.inv (ID = 0)
3:37 PM: order.spf (ID = 0)
3:37 PM: {master}.del (ID = 0)
3:37 PM: {master}.crn (ID = 0)
3:37 PM: prodsale.rwo (ID = 0)
3:37 PM: poitemdu.rwo (ID = 0)
3:37 PM: 0979.jpg (ID = 0)
3:37 PM: custsma4.rwo (ID = 0)
3:37 PM: alex.qot (ID = 0)
3:37 PM: order.spf (ID = 0)
3:37 PM: invoice.spf (ID = 0)
3:37 PM: credit.spf (ID = 0)
3:37 PM: crtlayot.spf (ID = 0)
3:37 PM: 0989.jpg (ID = 0)
3:37 PM: 14.jpg (ID = 0)
3:37 PM: {master}.inv (ID = 0)
3:37 PM: gstinc.inv (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: atenum32.dll (ID = 0)
3:37 PM: kit.spf (ID = 0)
3:37 PM: credit.spf (ID = 0)
3:37 PM: 0818_046b.jpg (ID = 0)
3:37 PM: dscf0050.jpg (ID = 0)
3:37 PM: windface.pra (ID = 0)
3:37 PM: {master}.pra (ID = 0)
3:37 PM: ausetp.spf (ID = 0)
3:37 PM: 04.mpeg (ID = 0)
3:37 PM: rfc.spf (ID = 0)
3:37 PM: c415-profile.jpg (ID = 0)
3:37 PM: standord.spf (ID = 0)
3:37 PM: atrw0960.rpw (ID = 0)
3:37 PM: atrw0950.rpw (ID = 0)
3:37 PM: atrw0900.rpw (ID = 0)
3:37 PM: proforma.spf (ID = 0)
3:37 PM: atrw0856.rpw (ID = 0)
3:37 PM: atrw0855.rpw (ID = 0)
3:37 PM: 4685c.jpg (ID = 0)
3:37 PM: atrw0820.rpw (ID = 0)
3:37 PM: {master}.pra (ID = 0)
3:37 PM: 020.jpg (ID = 0)
3:37 PM: barcode.cra (ID = 0)
3:37 PM: atrw0650.rpw (ID = 0)
3:37 PM: atrw0600.rpw (ID = 0)
3:37 PM: atrw0560.rpw (ID = 0)
3:37 PM: 4729.jpg (ID = 0)
3:37 PM: atrw0510.rpw (ID = 0)
3:37 PM: atrw0500.rpw (ID = 0)
3:37 PM: deisl1.isu (ID = 0)
3:37 PM: gstinc.crn (ID = 0)
3:37 PM: gstexcl.inv (ID = 0)
3:37 PM: deduct.dat (ID = 0)
3:37 PM: 11.jpg (ID = 0)
3:37 PM: {master}.crn (ID = 0)
3:37 PM: newwface.pra (ID = 0)
3:37 PM: a4wide.pra (ID = 0)
3:37 PM: atrw0470.rpw (ID = 0)
3:37 PM: invprnt.inv (ID = 0)
3:37 PM: costctr.dat (ID = 0)
3:37 PM: glmast.idx (ID = 0)
3:37 PM: addition.dat (ID = 0)
3:37 PM: atrw0450.rpw (ID = 0)
3:37 PM: {master}.cra (ID = 0)
3:37 PM: barcode.cra (ID = 0)
3:37 PM: atrw0400.rpw (ID = 0)
3:37 PM: atrw0370.rpw (ID = 0)
3:37 PM: atrw0330.rpw (ID = 0)
3:37 PM: atrw0320.rpw (ID = 0)
3:37 PM: dscf0044.jpg (ID = 0)
3:37 PM: dscf0066.jpg (ID = 0)
3:37 PM: aly14.jpg (ID = 0)
3:37 PM: atrw0310.rpw (ID = 0)
3:37 PM: atrw0305.rpw (ID = 0)
3:37 PM: atrw0300.rpw (ID = 0)
3:37 PM: atrw0280.rpw (ID = 0)
3:37 PM: atrw0275.rpw (ID = 0)
3:37 PM: atrw0272.rpw (ID = 0)
3:37 PM: atrw0270.rpw (ID = 0)
3:37 PM: atrw0255.rpw (ID = 0)
3:37 PM: atrw0250.rpw (ID = 0)
3:37 PM: atrw0240.rpw (ID = 0)
3:37 PM: tyra03.jpg (ID = 0)
3:37 PM: pic02.jpg (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: atrw0230.rpw (ID = 0)
3:37 PM: atrw0220.rpw (ID = 0)
3:37 PM: atrw0218.rpw (ID = 0)
3:37 PM: deduct.dat (ID = 0)
3:37 PM: atrw0215.rpw (ID = 0)
3:37 PM: atrw0200.rpw (ID = 0)
3:37 PM: costctr.dat (ID = 0)
3:37 PM: atrw0180.rpw (ID = 0)
3:37 PM: employee.dat (ID = 0)
3:37 PM: atrw0175.rpw (ID = 0)
3:37 PM: addition.dat (ID = 0)
3:37 PM: atrw0160.rpw (ID = 0)
3:37 PM: atrw0150.rpw (ID = 0)
3:37 PM: invoice.spf (ID = 0)
3:37 PM: rfc.spf (ID = 0)
3:37 PM: atrw0140.rpw (ID = 0)
3:37 PM: atrw0135.rpw (ID = 0)
3:37 PM: gstexcl.crn (ID = 0)
3:37 PM: atrw0130.rpw (ID = 0)
3:37 PM: atrw0120.rpw (ID = 0)
3:37 PM: ausper.spf (ID = 0)
3:37 PM: atrw0105.rpw (ID = 0)
3:37 PM: atrw0095.rpw (ID = 0)
3:37 PM: atrw0090.rpw (ID = 0)
3:37 PM: atrw0077.rpw (ID = 0)
3:37 PM: atrw0075.rpw (ID = 0)
3:37 PM: atrw0072.rpw (ID = 0)
3:37 PM: atrw0070.rpw (ID = 0)
3:37 PM: atrw0055.rpw (ID = 0)
3:37 PM: nikolinpanties012.jpg (ID = 0)
3:37 PM: nikolinpanties07.jpg (ID = 0)
3:37 PM: {master}.cra (ID = 0)
3:37 PM: atrw0040.rpw (ID = 0)
3:37 PM: atrw0020.rpw (ID = 0)
3:37 PM: {master}.sip (ID = 0)
3:37 PM: {master}.scp (ID = 0)
3:37 PM: {master}.rop (ID = 0)
3:37 PM: credit.spf (ID = 0)
3:37 PM: {master}.pop (ID = 0)
3:37 PM: {master}.gtp (ID = 0)
3:37 PM: {master}.grp (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: webdata1.idx (ID = 0)
3:37 PM: usermenu.idx (ID = 0)
3:37 PM: sysfile.idx (ID = 0)
3:37 PM: suppschg.idx (ID = 0)
3:37 PM: dscf0072.jpg (ID = 0)
3:37 PM: dscf0076.jpg (ID = 0)
3:37 PM: 10.jpg (ID = 0)
3:37 PM: pickprnt.pif (ID = 0)
3:37 PM: barcode.cra (ID = 0)
3:37 PM: pickprnt.jt.pif (ID = 0)
3:37 PM: packprnt.pif (ID = 0)
3:37 PM: invoice.spf (ID = 0)
3:37 PM: logfile.idx (ID = 0)
3:37 PM: logfile.dat (ID = 0)
3:37 PM: 6820.gif (ID = 0)
3:37 PM: keymessg.idx (ID = 0)
3:37 PM: 54.jpg (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: keymessg.dat (ID = 0)
3:37 PM: invprnt.pif (ID = 0)
3:37 PM: c425.jpg (ID = 0)
3:37 PM: deduct.dat (ID = 0)
3:37 PM: aly15.jpg (ID = 0)
3:37 PM: costctr.dat (ID = 0)
3:37 PM: invprnt.old.pif (ID = 0)
3:37 PM: gstfile.idx (ID = 0)
3:37 PM: grpname.idx (ID = 0)
3:37 PM: glset.idx (ID = 0)
3:37 PM: addition.dat (ID = 0)
3:37 PM: glset.dat (ID = 0)
3:37 PM: glrnd.dat (ID = 0)
3:37 PM: employee.dat (ID = 0)
3:37 PM: deduct.idx (ID = 0)
3:37 PM: deduct.dat (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: requ.spf (ID = 0)
3:37 PM: custmasx.idx (ID = 0)
3:37 PM: crthdr.idx (ID = 0)
3:37 PM: crtdtl.idx (ID = 0)
3:37 PM: crnprnt.pif (ID = 0)
3:37 PM: crnprnt.old.pif (ID = 0)
3:37 PM: bankfile.dat (ID = 0)
3:37 PM: addition.idx (ID = 0)
3:37 PM: addition.dat (ID = 0)
3:37 PM: {master}.chq (ID = 0)
3:37 PM: {master}.smt (ID = 0)
3:37 PM: glstdwrt.rwo (ID = 0)
3:37 PM: glstd005.rwo (ID = 0)
3:37 PM: menu0008.hlp (ID = 0)
3:37 PM: glstd004.rwo (ID = 0)
3:37 PM: order.spf (ID = 0)
3:37 PM: glstd003.rwo (ID = 0)
3:37 PM: glstd002.rwo (ID = 0)
3:37 PM: barcode.crn (ID = 0)
3:37 PM: 0818_022.jpg (ID = 0)
3:37 PM: thumbs.db (ID = 0)
3:37 PM: glstd001.rwo (ID = 0)
3:37 PM: glrepwrt.rwo (ID = 0)
3:37 PM: {master}.cra (ID = 0)
3:37 PM: glrep005.rwo (ID = 0)
3:37 PM: barcode.cra (ID = 0)
3:37 PM: glrep004.rwo (ID = 0)
3:37 PM: {master}.wra (ID = 0)
3:37 PM: glrep003.rwo (ID = 0)
3:37 PM: glrep002.rwo (ID = 0)
3:37 PM: glrep001.rwo (ID = 0)
3:37 PM: dscf0082.jpg (ID = 0)
3:37 PM: dscf0091.jpg (ID = 0)
3:37 PM: 11.jpg (ID = 0)
3:37 PM: index.jpg (ID = 0)
3:37 PM: webdata1.idx (ID = 0)
3:37 PM: webdata1.dat (ID = 0)
3:37 PM: sysfile.idx (ID = 0)
3:37 PM: supprnpr.idx (ID = 0)
3:37 PM: nikolinpanties013.jpg (ID = 0)
3:37 PM: nikolinpanties08.jpg (ID = 0)
3:37 PM: supprnpr.dat (ID = 0)
3:37 PM: supprncv.idx (ID = 0)
3:37 PM: visa.wra (ID = 0)
3:37 PM: supprncv.dat (ID = 0)
3:37 PM: supprmt3.idx (ID = 0)
3:37 PM: supprmt3.dat (ID = 0)
3:37 PM: supprms1.idx (ID = 0)
3:37 PM: supprms1.dat (ID = 0)
3:37 PM: suppmasx.idx (ID = 0)
3:37 PM: mastercd.wra (ID = 0)
3:37 PM: suppmasx.dat (ID = 0)
3:37 PM: suppmast.idx (ID = 0)
3:37 PM: suppgl.idx (ID = 0)
3:37 PM: suppgl.dat (ID = 0)
3:37 PM: suppeopr.dat (ID = 0)
3:37 PM: suppdsn1.idx (ID = 0)
3:37 PM: suppdsn1.dat (ID = 0)
3:37 PM: suppchq.idx (ID = 0)
3:37 PM: suppchq.dat (ID = 0)
3:37 PM: salmst05.idx (ID = 0)
3:37 PM: salmst05.dat (ID = 0)
3:37 PM: salmst04.idx (ID = 0)
3:37 PM: salmst04.dat (ID = 0)
3:37 PM: salmst03.idx (ID = 0)
3:37 PM: salmst03.dat (ID = 0)
3:37 PM: salmst02.idx (ID = 0)
3:37 PM: salmst02.dat (ID = 0)
3:37 PM: barcode.wra (ID = 0)
3:37 PM: salmst01.idx (ID = 0)
3:37 PM: salmst01.dat (ID = 0)
3:37 PM: saletran.dat (ID = 0)
3:37 PM: salesrep.idx (ID = 0)
3:37 PM: salesrep.dat (ID = 0)
3:37 PM: register.idx (ID = 0)
3:37 PM: recpt01.dat (ID = 0)
3:37 PM: prtdchqs.dat (ID = 0)
3:37 PM: prodprce.idx (ID = 0)
3:37 PM: prodprce.dat (ID = 0)
3:37 PM: prodasup.idx (ID = 0)
3:37 PM: prodasup.dat (ID = 0)
3:37 PM: prodalt.idx (ID = 0)
3:37 PM: prodalt.dat (ID = 0)
3:37 PM: pohdrx.dat (ID = 0)
3:37 PM: ostran.idx (ID = 0)
3:37 PM: sysfile.dat (ID = 0)
3:37 PM: ostran.dat (ID = 0)
3:37 PM: oscrcy.idx (ID = 0)
3:37 PM: oscrcy.dat (ID = 0)
3:37 PM: locnname.idx (ID = 0)
3:37 PM: locnname.dat (ID = 0)
3:37 PM: keymessg.idx (ID = 0)
3:37 PM: keymessg.dat (ID = 0)
3:37 PM: invhdr.idx (ID = 0)
3:37 PM: gstfile.idx (ID = 0)
3:37 PM: gstaud.idx (ID = 0)
3:37 PM: grpname.idx (ID = 0)
3:37 PM: grpname.dat (ID = 0)
3:37 PM: glset.idx (ID = 0)
3:37 PM: glrnd.idx (ID = 0)
3:37 PM: glnarr.idx (ID = 0)
3:37 PM: glmastly.idx (ID = 0)
3:37 PM: employee.dat (ID = 0)
3:37 PM: custsch.idx (ID = 0)
3:37 PM: custsch.dat (ID = 0)
3:37 PM: custmasx.idx (ID = 0)
3:38 PM: custmast.idx (ID = 0)
3:38 PM: custgl.idx (ID = 0)
3:38 PM: custdel.idx (ID = 0)
3:38 PM: custdel.dat (ID = 0)
3:38 PM: custbank.idx (ID = 0)
3:38 PM: custbank.dat (ID = 0)
3:38 PM: crthdr.idx (ID = 0)
3:38 PM: crtdtl.idx (ID = 0)
3:38 PM: comment.idx (ID = 0)
3:38 PM: comment.dat (ID = 0)
3:38 PM: cbrep.dat (ID = 0)
3:38 PM: cbprfrmd.idx (ID = 0)
3:38 PM: cbbnkrec.idx (ID = 0)
3:38 PM: bnkdetls.idx (ID = 0)
3:38 PM: bnkdetls.dat (ID = 0)
3:38 PM: bankfile.dat (ID = 0)
3:38 PM: {master}.chq (ID = 0)
3:38 PM: usermenu.idx (ID = 0)
3:38 PM: usermenu.dat (ID = 0)
3:38 PM: taxscale.idx (ID = 0)
3:38 PM: sysfile.idx (ID = 0)
3:38 PM: sysfile.dat (ID = 0)
3:38 PM: ppoint.idx (ID = 0)
3:38 PM: ppoint.dat (ID = 0)
3:38 PM: position.dat (ID = 0)
3:38 PM: payrgl.idx (ID = 0)
3:38 PM: payrgl.dat (ID = 0)
3:38 PM: payleave.rwo (ID = 0)
3:38 PM: overtime.idx (ID = 0)
3:38 PM: overtime.dat (ID = 0)
3:38 PM: logfile.idx (ID = 0)
3:38 PM: logfile.dat (ID = 0)
3:38 PM: leaveacc.idx (ID = 0)
3:38 PM: leaveacc.dat (ID = 0)
3:38 PM: keymessg.idx (ID = 0)
3:38 PM: keymessg.dat (ID = 0)
3:38 PM: income.idx (ID = 0)
3:38 PM: income.dat (ID = 0)
3:38 PM: employee.idx (ID = 0)
3:38 PM: deduct.idx (ID = 0)
3:38 PM: costctr.idx (ID = 0)
3:38 PM: contrib.idx (ID = 0)
3:38 PM: contrib.dat (ID = 0)
3:38 PM: comment.idx (ID = 0)
3:38 PM: comment.dat (ID = 0)
3:38 PM: bnkdetls.idx (ID = 0)
3:38 PM: bnkdetls.dat (ID = 0)
3:38 PM: bankacct.idx (ID = 0)
3:38 PM: bankacct.dat (ID = 0)
3:38 PM: addition.idx (ID = 0)
3:38 PM: {master}.chq (ID = 0)
3:38 PM: usermenu.idx (ID = 0)
3:38 PM: usermenu.dat (ID = 0)
3:38 PM: taxscale.idx (ID = 0)
3:38 PM: sysfile.idx (ID = 0)
3:38 PM: sysfile.dat (ID = 0)
3:38 PM: ppoint.idx (ID = 0)
3:38 PM: ppoint.dat (ID = 0)
3:38 PM: position.idx (ID = 0)
3:38 PM: payrgl.idx (ID = 0)
3:38 PM: payrgl.dat (ID = 0)
3:38 PM: payleave.rwo (ID = 0)
3:38 PM: overtime.idx (ID = 0)
3:38 PM: overtime.dat (ID = 0)
3:38 PM: logfile.idx (ID = 0)
3:38 PM: logfile.dat (ID = 0)
3:38 PM: leaveacc.idx (ID = 0)
3:38 PM: leaveacc.dat (ID = 0)
3:38 PM: keymessg.idx (ID = 0)
3:38 PM: keymessg.dat (ID = 0)
3:38 PM: income.idx (ID = 0)
3:38 PM: income.dat (ID = 0)
3:38 PM: employee.idx (ID = 0)
3:38 PM: deduct.idx (ID = 0)
3:38 PM: costctr.idx (ID = 0)
3:38 PM: contrib.idx (ID = 0)
3:38 PM: contrib.dat (ID = 0)
3:38 PM: comment.idx (ID = 0)
3:38 PM: comment.dat (ID = 0)
3:38 PM: bnkdetls.idx (ID = 0)
3:38 PM: bnkdetls.dat (ID = 0)
3:38 PM: bankacct.idx (ID = 0)
3:38 PM: bankacct.dat (ID = 0)
3:38 PM: addition.idx (ID = 0)
3:38 PM: {master}.chq (ID = 0)
3:38 PM: usermenu.idx (ID = 0)
3:38 PM: usermenu.dat (ID = 0)
3:38 PM: taxscale.idx (ID = 0)
3:38 PM: sysfile.idx (ID = 0)
3:38 PM: sysfile.dat (ID = 0)
3:38 PM: ppoint.idx (ID = 0)
3:38 PM: ppoint.dat (ID = 0)
3:38 PM: position.dat (ID = 0)
3:38 PM: overtime.idx (ID = 0)
3:38 PM: overtime.dat (ID = 0)
3:38 PM: leaveacc.idx (ID = 0)
3:38 PM: leaveacc.dat (ID = 0)
3:38 PM: income.idx (ID = 0)
3:38 PM: income.dat (ID = 0)
3:38 PM: employee.dat (ID = 0)
3:38 PM: deduct.idx (ID = 0)
3:38 PM: costctr.idx (ID = 0)
3:38 PM: contrib.idx (ID = 0)
3:38 PM: contrib.dat (ID = 0)
3:38 PM: bnkdetls.idx (ID = 0)
3:38 PM: bnkdetls.dat (ID = 0)
3:38 PM: addition.idx (ID = 0)
3:38 PM: {master}.chq (ID = 0)
3:38 PM: glstdwrt.rwo (ID = 0)
3:38 PM: glstd005.rwo (ID = 0)
3:38 PM: glstd004.rwo (ID = 0)
3:38 PM: glstd003.rwo (ID = 0)
3:38 PM: glstd002.rwo (ID = 0)
3:38 PM: glstd001.rwo (ID = 0)
3:38 PM: glrepwrt.rwo (ID = 0)
3:38 PM: prodlabl.idx (ID = 0)
3:38 PM: prodgl.idx (ID = 0)
3:38 PM: glrep005.rwo (ID = 0)
3:38 PM: glrep004.rwo (ID = 0)
3:38 PM: glrep003.rwo (ID = 0)
3:38 PM: glrep002.rwo (ID = 0)
3:38 PM: taxscale.idx (ID = 0)
3:38 PM: 10.jpg (ID = 0)
3:38 PM: sysfile.idx (ID = 0)
3:38 PM: saletran.dat (ID = 0)
3:38 PM: prodtrn.idx (ID = 0)
3:38 PM: prodtrn.dat (ID = 0)
3:38 PM: ausvol.spf (ID = 0)
3:38 PM: tearoff.smt (ID = 0)
3:38 PM: prodmast.dat (ID = 0)
3:38 PM: prodmast.idx (ID = 0)
3:38 PM: position.dat (ID = 0)
3:38 PM: invdtl.dat (ID = 0)
3:38 PM: 002.jpg (ID = 0)
3:38 PM: 003.jpg (ID = 0)
3:38 PM: 03.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: locnname.idx (ID = 0)
3:38 PM: locnname.dat (ID = 0)
3:38 PM: invhdrx.idx (ID = 0)
3:38 PM: invhdrx.dat (ID = 0)
3:38 PM: invhdr.idx (ID = 0)
3:38 PM: kit.spf (ID = 0)
3:38 PM: invhdr.dat (ID = 0)
3:38 PM: invdtl.idx (ID = 0)
3:38 PM: glset.idx (ID = 0)
3:38 PM: prodalt.idx (ID = 0)
3:38 PM: glset.dat (ID = 0)
3:38 PM: prodalt.dat (ID = 0)
3:38 PM: custmasx.dat (ID = 0)
3:38 PM: poscrsiv.pif (ID = 0)
3:38 PM: employee.dat (ID = 0)
3:38 PM: custtrn.idx (ID = 0)
3:38 PM: custtrn.dat (ID = 0)
3:38 PM: custmast.dat (ID = 0)
3:38 PM: costctr.dat (ID = 0)
3:38 PM: tax.n (ID = 0)
3:38 PM: suppmasx.idx (ID = 0)
3:38 PM: suppmasx.dat (ID = 0)
3:38 PM: remit.spf (ID = 0)
3:38 PM: custmasx.idx (ID = 0)
3:38 PM: custmast.idx (ID = 0)
3:38 PM: suppmast.idx (ID = 0)
3:38 PM: suppeopr.dat (ID = 0)
3:38 PM: suppchq.idx (ID = 0)
3:38 PM: suppchq.dat (ID = 0)
3:38 PM: salesrep.idx (ID = 0)
3:38 PM: salesrep.dat (ID = 0)
3:38 PM: 1005.jpg (ID = 0)
3:38 PM: custgl.idx (ID = 0)
3:38 PM: 003.jpg (ID = 0)
3:38 PM: custgl.dat (ID = 0)
3:38 PM: costctr.idx (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: ausetp2.spf (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: jl300522.jpg_1 (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: atbpform.spf (ID = 0)
3:38 PM: depslip.spf (ID = 0)
3:38 PM: teen06.jpg (ID = 0)
3:38 PM: atprt16.dll (ID = 0)
3:38 PM: staterem.smt (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: f1637+.jpg (ID = 0)
3:38 PM: poscrscn.pif (ID = 0)
3:38 PM: auslab.spf (ID = 0)
3:38 PM: 11.jpg (ID = 0)
3:38 PM: 13.jpg (ID = 0)
3:38 PM: statemnt.smt (ID = 0)
3:38 PM: 12.jpg (ID = 0)
3:38 PM: glrep001.rwo (ID = 0)
3:38 PM: requ.spf (ID = 0)
3:38 PM: webdata1.dat (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: prefprod.spf (ID = 0)
3:38 PM: kayla-end.mpeg (ID = 0)
3:38 PM: kit.spf (ID = 0)
3:38 PM: 15.jpg (ID = 0)
3:38 PM: taxscale.dat (ID = 0)
3:38 PM: grpname.idx (ID = 0)
3:38 PM: tax.a (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: polayout.spf (ID = 0)
3:38 PM: grn.spf (ID = 0)
3:38 PM: teen05.jpg (ID = 0)
3:38 PM: 005.jpg (ID = 0)
3:38 PM: 006.jpg (ID = 0)
3:38 PM: oilayout.spf (ID = 0)
3:38 PM: 4.jpg (ID = 0)
3:38 PM: tax.w (ID = 0)
3:38 PM: hdk3ht16.dll (ID = 0)
3:38 PM: tax.p (ID = 0)
3:38 PM: hdk3cryp.dll (ID = 0)
3:38 PM: sysfile.idx (ID = 0)
3:38 PM: hdk3cr16.dll (ID = 0)
3:38 PM: sysfile.dat (ID = 0)
3:38 PM: atenum16.dll (ID = 0)
3:38 PM: 3.jpg (ID = 0)
3:38 PM: atsequ.spf (ID = 0)
3:38 PM: 32.mpeg (ID = 0)
3:38 PM: discoverlounges_1762_7433692.jpg (ID = 0)
3:38 PM: usermenu.dat (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 13.jpg (ID = 0)
3:38 PM: 006.jpg (ID = 0)
3:38 PM: cpnw-corsette_0265.jpg (ID = 0)
3:38 PM: 11.jpg (ID = 0)
3:38 PM: zbthumbnail.info (ID = 0)
3:38 PM: 001.jpg (ID = 0)
3:38 PM: 03.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: danoo037.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: dscf0142.jpg (ID = 0)
3:38 PM: dscf0157.jpg (ID = 0)
3:38 PM: pic05.jpg (ID = 0)
3:38 PM: 5.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 8.jpg (ID = 0)
3:38 PM: 9.jpg (ID = 0)
3:38 PM: kristin63_07.jpg (ID = 0)
3:38 PM: poscrreq.pif (ID = 0)
3:38 PM: prodprce.idx (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: tyra04.jpg (ID = 0)
3:38 PM: pic12.jpg (ID = 0)
3:38 PM: pic14.jpg (ID = 0)
3:38 PM: lyuvo046.jpg (ID = 0)
3:38 PM: 001.jpg (ID = 0)
3:38 PM: 004.jpg (ID = 0)
3:38 PM: 04.jpg (ID = 0)
3:38 PM: p02.jpg (ID = 0)
3:38 PM: p06.jpg (ID = 0)
3:38 PM: tyra05.jpg (ID = 0)
3:38 PM: pic13.jpg (ID = 0)
3:38 PM: pic15.jpg (ID = 0)
3:38 PM: atkwrd.spf (ID = 0)
3:38 PM: tyra07.jpg (ID = 0)
3:38 PM: tyra16.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: pic16.jpg (ID = 0)
3:38 PM: 01.jpg (ID = 0)
3:38 PM: 02.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 03.jpg (ID = 0)
3:38 PM: 04.jpg (ID = 0)
3:38 PM: teen05.jpg (ID = 0)
3:38 PM: p0025378.jpg (ID = 0)
3:38 PM: 4946.jpg (ID = 0)
3:38 PM: p09.jpg (ID = 0)
3:38 PM: p13.jpg (ID = 0)
3:38 PM: tyra01.jpg (ID = 0)
3:38 PM: 05.jpg (ID = 0)
3:38 PM: 09.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 007.jpg (ID = 0)
3:38 PM: 014.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 10.jpg (ID = 0)
3:38 PM: 13.jpg (ID = 0)
3:38 PM: zbthumbnail.info (ID = 0)
3:38 PM: {master}.cra (ID = 0)
3:38 PM: windface.pra (ID = 0)
3:38 PM: 4460b.jpg (ID = 0)
3:38 PM: 05.jpg (ID = 0)
3:38 PM: 5.jpg (ID = 0)
3:38 PM: poscrord.pif (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: zu1po035.jpg (ID = 0)
3:38 PM: discoverlounges_1762_8193199.jpg (ID = 0)
3:38 PM: 1.jpg (ID = 0)
3:38 PM: 003.jpg (ID = 0)
3:38 PM: 7.jpg (ID = 0)
3:38 PM: 9.jpg (ID = 0)
3:38 PM: 003.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 4460.jpg (ID = 0)
3:38 PM: sisuo024.jpg (ID = 0)
3:38 PM: jap261x007.jpg (ID = 0)
3:38 PM: jap261x011.jpg (ID = 0)
3:38 PM: jap261x015.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 09.jpg (ID = 0)
3:38 PM: 020.jpg (ID = 0)
3:38 PM: 0818_034.jpg (ID = 0)
3:38 PM: a.mpeg (ID = 0)
3:38 PM: 0818_014.jpg (ID = 0)
3:38 PM: 0818_036.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: nikolinpanties014.jpg (ID = 0)
3:38 PM: nikolinpanties03.jpg (ID = 0)
3:38 PM: lb02.jpg (ID = 0)
3:38 PM: pic04.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: nikolinpanties015.jpg (ID = 0)
3:38 PM: 001.jpg (ID = 0)
3:38 PM: nikolinpanties02.jpg (ID = 0)
3:38 PM: nikolinpanties09.jpg (ID = 0)
3:38 PM: scawx026.jpg (ID = 0)
3:38 PM: pic06.jpg (ID = 0)
3:38 PM: 001483.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: nikolinpanties04.jpg (ID = 0)
3:38 PM: 003.jpg (ID = 0)
3:38 PM: 01.jpg (ID = 0)
3:38 PM: 02.jpg (ID = 0)
3:38 PM: nikolinpanties05.jpg (ID = 0)
3:38 PM: 007.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 0010.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: catindrchr006.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: catindrchr017.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: discoverlounges_1762_8954097.jpg (ID = 0)
3:38 PM: 07.jpg (ID = 0)
3:38 PM: 15.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 10.jpg (ID = 0)
3:38 PM: 6.jpg (ID = 0)
3:38 PM: pic07.jpg (ID = 0)
3:38 PM: v-084f.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 03.jpg (ID = 0)
3:38 PM: a-d49-red-leather.jpg (ID = 0)
3:38 PM: a-d50-suede-brown.jpg (ID = 0)
3:38 PM: img7562.jpg (ID = 0)
3:38 PM: nikolinpanties011.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: catindrchr061.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: img7564.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 1037.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: vo-4002u.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: img7566.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 2.jpg (ID = 0)
3:38 PM: 2.jpg (ID = 0)
3:38 PM: 4.jpg (ID = 0)
3:38 PM: pic09.jpg (ID = 0)
3:38 PM: 08.jpg (ID = 0)
3:38 PM: img7569.jpg (ID = 0)
3:38 PM: 3.jpg (ID = 0)
3:38 PM: 5.jpg (ID = 0)
3:38 PM: 001.jpg (ID = 0)
3:38 PM: 9.jpg (ID = 0)
3:38 PM: 006.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: catindrchr085.jpg (ID = 0)
3:38 PM: thumbs.db (ID = 0)
3:38 PM: 9.jpg (ID = 0)
3:38 PM: 009.jpg (ID = 0)
3:38 PM: 013.jpg (ID = 0)
3:38 PM: nikolinpanties01.jpg (ID = 0)
3:38 PM: 002.jpg (ID = 0)
3:38 PM: 03.jpg (ID = 0)
3:38 PM: p00.jpg (ID = 0)
3:38 PM: p03.jpg (ID = 0)
3:38 PM: 018.jpg (ID = 0)
3:38 PM: nikolinpanties010.jpg (ID = 0)
3:38 PM: a-d50-suede-cream.jpg (ID = 0)
3:38 PM: 1.mpeg (ID = 0)
3:38 PM: 10.jpg (ID = 0)
3:38 PM: 02.mpeg (ID = 0)
3:38 PM: 03.mpeg (ID = 0)
3:38 PM: 3.mpeg (ID = 0)
3:38 PM: freshteens265.mpeg (ID = 0)
3:38 PM: 00031.mpg (ID = 0)
3:38 PM: 00041.mpg (ID = 0)
3:38 PM: 001b.mpg (ID = 0)
3:38 PM: 0020.mpeg (ID = 0)
3:38 PM: 00201.mpeg (ID = 0)
3:38 PM: 004.jpg (ID = 0)
3:38 PM: 006.jpg (ID = 0)
3:38 PM: zbthumbnail.info (ID = 0)
3:38 PM: 02xx.mpg (ID = 0)
3:38 PM: 03xx.mpg (ID = 0)
3:38 PM: 000111.mpg (ID = 0)
3:38 PM: lyuvo030.jpg (ID = 0)
3:38 PM: 15.jpg (ID = 0)
3:38 PM: pic01.jpg (ID = 0)
3:38 PM: 07.jpg (ID = 0)
3:38 PM: 15.jpg (ID = 0)
3:38 PM: 16.jpg (ID = 0)
3:38 PM: 01.jpg (ID = 0)
3:38 PM: 02.jpg (ID = 0)
3:38 PM: 11.jpg (ID = 0)
3:38 PM: 12.jpg (ID = 0)
3:38 PM: 13.jpg (ID = 0)
3:38 PM: 14.jpg (ID = 0)
3:38 PM: zbthumbnail.info (ID = 0)
3:38 PM: 32..mpg (ID = 0)
3:38 PM: vervo018.jpg (ID = 0)
3:38 PM: 3.wmv (ID = 0)
3:38 PM: ptroo015.jpg (ID = 0)
3:38 PM: 03.jpg (ID = 0)
3:38 PM: 04.jpg (ID = 0)
3:38 PM: 05.jpg (ID = 0)
3:38 PM: 06.jpg (ID = 0)
3:38 PM: 3.mpg (ID = 0)
3:38 PM: 002.jpg (ID = 0)
3:38 PM: 003.jpg (ID = 0)
3:38 PM: 4.mpg (ID = 0)
3:38 PM: 5.mpg (ID = 0)
3:38 PM: 16.jpg (ID = 0)
3:38 PM: 307rt37_02.mpg (ID = 0)
3:38 PM: 307rt37_03.mpg (ID = 0)
3:38 PM: 307rt37_04.mpg (ID = 0)
3:38 PM: 324re51_03.mpg (ID = 0)
3:38 PM: 41.wmv (ID = 0)
3:38 PM: 472_1.mpg (ID = 0)
3:38 PM: 51.mpg (ID = 0)
3:38 PM: 546_2.mpg (ID = 0)
3:38 PM: 6.mpg (ID = 0)
3:38 PM: 7.mpg (ID = 0)
3:38 PM: 8.mpg (ID = 0)
3:38 PM: 81.mpg (ID = 0)
3:38 PM: 9.mpg (ID = 0)
3:38 PM: ad1.wmv (ID = 0)
3:38 PM: ad2.wmv (ID = 0)
3:38 PM: ad3.wmv (ID = 0)
3:38 PM: ad4.wmv (ID = 0)
3:38 PM: ad5.wmv (ID = 0)
3:38 PM: ad6.wmv (ID = 0)
3:38 PM: alexis01.mpg (ID = 0)
3:38 PM: amber01.mpg (ID = 0)
3:38 PM: amber02.mpg (ID = 0)
3:38 PM: amber1.wmv (ID = 0)
3:38 PM: amber2.wmv (ID = 0)
3:38 PM: amber4.wmv (ID = 0)
3:38 PM: bb2.mpg (ID = 0)
3:38 PM: img7550.jpg (ID = 0)
3:38 PM: picture%20105.jpg (ID = 0)
3:38 PM: amber5.wmv (ID = 0)
3:38 PM: amber6.wmv (ID = 0)
3:38 PM: andrea05a.mpg (ID = 0)
3:38 PM: austin3.mpg (ID = 0)
3:38 PM: awesomejen7.wmv (ID = 0)
3:38 PM: bb5.mpg (ID = 0)
3:38 PM: cf_honey_03.mpg (ID = 0)
3:38 PM: cf_maddy_02.mpg (ID = 0)
3:38 PM: claire1.wmv (ID = 0)
3:38 PM: clip003.mpg (ID = 0)
3:38 PM: clip_003.wmv (ID = 0)
3:38 PM: esp_lea_01.mpg (ID = 0)
3:38 PM: esp_lea_02.mpg (ID = 0)
3:38 PM: esp_lea_03.mpg (ID = 0)
3:38 PM: esp_lea_04.mpg (ID = 0)
3:38 PM: esp_lea_05.mpg (ID = 0)
3:38 PM: esp_lea_06.mpg (ID = 0)
3:38 PM: estefana1.wmv (ID = 0)
3:38 PM: felony1.mpg (ID = 0)
3:38 PM: [bleep]2.mpg (ID = 0)
3:38 PM: [bleep]3.mpg (ID = 0)
3:38 PM: gggggggg.mpg (ID = 0)
3:38 PM: hfbc001c.avi (ID = 0)
3:38 PM: hma01a.wmv (ID = 0)
3:38 PM: hma01b.wmv (ID = 0)
3:38 PM: hma01c.wmv (ID = 0)
3:38 PM: hma01d.wmv (ID = 0)
3:38 PM: hma01e.wmv (ID = 0)
3:38 PM: hma01f.wmv (ID = 0)
3:38 PM: jjjjjjjjjj.mpg (ID = 0)
3:38 PM: lesbians_movie_04.mpg (ID = 0)
3:38 PM: max-04.mpg (ID = 0)
3:38 PM: michelle.mpg (ID = 0)
3:38 PM: movie001..mpg (ID = 0)
3:38 PM: movie002..mpg (ID = 0)
3:38 PM: movie004..mpg (ID = 0)
3:38 PM: movie007..mpg (ID = 0)
3:38 PM: movie03.mpg (ID = 0)
3:38 PM: oral001f.wmv (ID = 0)
3:38 PM: preview1.mpg (ID = 0)
3:38 PM: preview2.mpg (ID = 0)
3:38 PM: preview3.mpg (ID = 0)
3:38 PM: reese03.mpg (ID = 0)
3:38 PM: rene11.wmv (ID = 0)
3:38 PM: rene13.wmv (ID = 0)
3:38 PM: rene16.wmv (ID = 0)
3:38 PM: rene2.wmv (ID = 0)
3:38 PM: rene25.wmv (ID = 0)
3:38 PM: rene6.wmv (ID = 0)
3:38 PM: sample5.mpg (ID = 0)
3:38 PM: sex_xxx_02.mpg (ID = 0)
3:38 PM: terri1.wmv (ID = 0)
3:38 PM: trishrebectgp5.mpg (ID = 0)
3:38 PM: trishrebectgp7.mpg (ID = 0)
3:38 PM: v00073_t11_350.mpg (ID = 0)
3:38 PM: v00073_t16_350.mpg (ID = 0)
3:38 PM: v00073_t20_350.mpg (ID = 0)
3:38 PM: v00392_t1_650.mpg (ID = 0)
3:38 PM: v00392_t2_650.mpg (ID = 0)
3:38 PM: v00392_t3_650.mpg (ID = 0)
3:38 PM: v00392_t4_650.mpg (ID = 0)
3:38 PM: v00392_t5_650.mpg (ID = 0)
3:38 PM: web01.wmv (ID = 0)
3:38 PM: web02.wmv (ID = 0)
3:38 PM: web03.wmv (ID = 0)
3:38 PM: web04.wmv (ID = 0)
3:38 PM: 288df18_03.mpg (ID = 0)
3:38 PM: 288df18_04.mpg (ID = 0)
3:38 PM: 288df18_05.mpg (ID = 0)
3:38 PM: 288df18_06.mpg (ID = 0)
3:38 PM: charlottetgpxx5.mpg (ID = 0)
3:38 PM: office2.wmv (ID = 0)
3:38 PM: toybox.wmv (ID = 0)
3:38 PM: 14.jpg (ID = 0)
3:38 PM: pic03.jpg (ID = 0)
3:38 PM: glmast.dat (ID = 0)
3:38 PM: c2.mpeg (ID = 0)
3:38 PM: 010.jpg (ID = 0)
3:38 PM: hfls001_004.wmv (ID = 0)
3:38 PM: 02.wmv (ID = 0)
3:38 PM: kayla-[bleep].mpeg (ID = 0)
3:38 PM: 0020111.mpeg (ID = 0)
3:38 PM: 0020a.mpeg (ID = 0)
3:38 PM: 0020bbhg.mpeg (ID = 0)
3:38 PM: 0021.mpg (ID = 0)
3:38 PM: 002b.mpg (ID = 0)
3:38 PM: 0030.mpeg (ID = 0)
3:38 PM: 00301.mpeg (ID = 0)
3:38 PM: 0030a.mpeg (ID = 0)
3:39 PM: 0030ff.mpeg (ID = 0)
3:39 PM: 0030xx.mpeg (ID = 0)
3:39 PM: 0031.mpg (ID = 0)
3:39 PM: 003b.mpg (ID = 0)
3:39 PM: 0040.mpeg (ID = 0)
3:39 PM: 00401.mpeg (ID = 0)
3:39 PM: 0040a.mpeg (ID = 0)
3:39 PM: 0040ff.mpeg (ID = 0)
3:39 PM: 0040xx.mpeg (ID = 0)
3:39 PM: 004ss.mpg (ID = 0)
3:39 PM: 01.mpg (ID = 0)
3:39 PM: 012.mpg (ID = 0)
3:39 PM: 01aa.mpg (ID = 0)
3:39 PM: 02.mpg (ID = 0)
3:39 PM: 021.mpg (ID = 0)
3:39 PM: 021a.mpg (ID = 0)
3:39 PM: 02aa.mpg (ID = 0)
3:39 PM: 03.mpg (ID = 0)
3:39 PM: 031.mpg (ID = 0)
3:39 PM: 04.mpg (ID = 0)
3:39 PM: 041.mpg (ID = 0)
3:39 PM: 042.mpg (ID = 0)
3:39 PM: 05.mpg (ID = 0)
3:39 PM: 051.mpg (ID = 0)
3:39 PM: 052.mpg (ID = 0)
3:39 PM: 053.mpg (ID = 0)
3:39 PM: 06.mpg (ID = 0)
3:39 PM: 061.mpg (ID = 0)
3:39 PM: 062.mpg (ID = 0)
3:39 PM: 063.mpg (ID = 0)
3:39 PM: 064.mpg (ID = 0)
3:39 PM: 06aa.mpg (ID = 0)
3:39 PM: 07.mpg (ID = 0)
3:39 PM: 071.mpg (ID = 0)
3:39 PM: 07n.mpg (ID = 0)
3:39 PM: 08.mpg (ID = 0)
3:39 PM: 081.mpg (ID = 0)
3:39 PM: 08n.mpg (ID = 0)
3:39 PM: 09.mpg (ID = 0)
3:39 PM: 091.mpg (ID = 0)
3:39 PM: 1..a.mpg (ID = 0)
3:39 PM: 1.mpg (ID = 0)
3:39 PM: 1.wmv (ID = 0)
3:39 PM: 10.mpg (ID = 0)
3:39 PM: 101.mpg (ID = 0)
3:39 PM: 102.mpg (ID = 0)
3:39 PM: 103.mpg (ID = 0)
3:39 PM: 11.wmv (ID = 0)
3:39 PM: 12..mpg (ID = 0)
3:39 PM: 2...mpg (ID = 0)
3:39 PM: 2.mpg (ID = 0)
3:39 PM: 2.wmv (ID = 0)
3:39 PM: 21.wmv (ID = 0)
3:39 PM: 22..mpg (ID = 0)
3:39 PM: 26.wmv (ID = 0)
3:39 PM: 294sp24_01.mpg (ID = 0)
3:39 PM: 294sp24_02.mpg (ID = 0)
3:39 PM: 294sp24_03.mpg (ID = 0)
3:39 PM: 294sp24_04.mpg (ID = 0)
3:39 PM: 294sp24_05.mpg (ID = 0)
3:39 PM: 294sp24_06.mpg (ID = 0)
3:39 PM: 297rd27_05.mpg (ID = 0)
3:39 PM: 10.wmv (ID = 0)
3:39 PM: 2.wmv (ID = 0)
3:39 PM: 3.wmv (ID = 0)
3:39 PM: 4.wmv (ID = 0)
3:39 PM: 5.wmv (ID = 0)
3:39 PM: 6.wmv (ID = 0)
3:39 PM: 7.wmv (ID = 0)
3:39 PM: movie1.mpg (ID = 0)
3:39 PM: movie2.mpg (ID = 0)
3:39 PM: movie3.mpg (ID = 0)
3:39 PM: movie4.mpg (ID = 0)
3:39 PM: movie5.mpg (ID = 0)
3:39 PM: movie6.mpg (ID = 0)
3:39 PM: 1.mpg (ID = 0)
3:39 PM: 2.mpg (ID = 0)
3:39 PM: 3.mpg (ID = 0)
3:39 PM: 4.mpg (ID = 0)
3:39 PM: 5.mpg (ID = 0)
3:39 PM: 1.mpg (ID = 0)
3:39 PM: 2.mpg (ID = 0)
3:39 PM: 3.mpg (ID = 0)
3:39 PM: 4.mpg (ID = 0)
3:39 PM: 5.mpg (ID = 0)
3:39 PM: 6.mpg (ID = 0)
3:39 PM: 7.mpg (ID = 0)
3:39 PM: 8.mpg (ID = 0)
3:39 PM: movie77.mpeg (ID = 0)
3:39 PM: 289sd19_03.mpg (ID = 0)
3:39 PM: cf_cierra_01.mpg (ID = 0)
3:39 PM: cf_cierra_03.mpg (ID = 0)
3:39 PM: cf_cierra_04.mpg (ID = 0)
3:39 PM: cf_cierra_05.mpg (ID = 0)
3:39 PM: cf_cierra_06.mpg (ID = 0)
3:39 PM: 11.mpg (ID = 0)
3:39 PM: 21.mpg (ID = 0)
3:39 PM: 31.mpg (ID = 0)
3:39 PM: wlt_justine_01.mpg (ID = 0)
3:39 PM: wlt_justine_02.mpg (ID = 0)
3:39 PM: wlt_justine_03.mpg (ID = 0)
3:39 PM: wlt_justine_04.mpg (ID = 0)
3:39 PM: wlt_justine_05.mpg (ID = 0)
3:39 PM: wlt_justine_06.mpg (ID = 0)
3:39 PM: fpv_tvc_large.wmv (ID = 0)
3:39 PM: movie001.mpg (ID = 0)
3:39 PM: movie002.mpg (ID = 0)
3:39 PM: movie003.mpg (ID = 0)
3:39 PM: movie004.mpg (ID = 0)
3:39 PM: movie005.mpg (ID = 0)
3:39 PM: movie006.mpg (ID = 0)
3:39 PM: movie007.mpg (ID = 0)
3:39 PM: movie008.mpg (ID = 0)
3:39 PM: movie009.mpg (ID = 0)
3:39 PM: video01.mpg (ID = 0)
3:39 PM: video02.mpg (ID = 0)
3:39 PM: video03.mpg (ID = 0)
3:39 PM: video04.mpg (ID = 0)
3:39 PM: julie10.wmv (ID = 0)
3:39 PM: julie12.wmv (ID = 0)
3:39 PM: julie14.wmv (ID = 0)
3:39 PM: julie18.wmv (ID = 0)
3:39 PM: julie23.wmv (ID = 0)
3:39 PM: julie31.wmv (ID = 0)
3:39 PM: 0020.mpeg (ID = 0)
3:39 PM: 0030.mpeg (ID = 0)
3:39 PM: movie001.mpg (ID = 0)
3:39 PM: movie002.mpg (ID = 0)
3:39 PM: movie003.mpg (ID = 0)
3:39 PM: movie004.mpg (ID = 0)
3:39 PM: movie005.mpg (ID = 0)
3:39 PM: movie006.mpg (ID = 0)
3:39 PM: movie007.mpg (ID = 0)
3:39 PM: movie008.mpg (ID = 0)
3:39 PM: movie009.mpg (ID = 0)
3:39 PM: 0020.mpeg (ID = 0)
3:39 PM: 0030.mpeg (ID = 0)
3:39 PM: 0040.mpeg (ID = 0)
3:39 PM: video01d.wmv (ID = 0)
3:39 PM: video02d.wmv (ID = 0)
3:39 PM: video03d.wmv (ID = 0)
3:39 PM: video04d.wmv (ID = 0)
3:39 PM: orgasm-02.mpg (ID = 0)
3:39 PM: orgasm-03.mpg (ID = 0)
3:39 PM: orgasm-04.mpg (ID = 0)
3:39 PM: orgasm-05.mpg (ID = 0)
3:39 PM: 10.jpg (ID = 0)
3:39 PM: 7.jpg (ID = 0)
3:39 PM: 9.jpg (ID = 0)
3:39 PM: 15.jpg (ID = 0)
3:39 PM: 18.jpg (ID = 0)
3:39 PM: 20.jpg (ID = 0)
3:39 PM: big10.jpg (ID = 0)
3:39 PM: big4.jpg (ID = 0)
3:39 PM: big6.jpg (ID = 0)
3:39 PM: 14.jpg (ID = 0)
3:39 PM: 3.jpg (ID = 0)
3:39 PM: 4.jpg (ID = 0)
3:39 PM: 5.jpg (ID = 0)
3:39 PM: 7.jpg (ID = 0)
3:39 PM: 01_28694.jpg (ID = 0)
3:39 PM: 02_31015.jpg (ID = 0)
3:39 PM: 03_32396.jpg (ID = 0)
3:39 PM: 04_34316.jpg (ID = 0)
3:39 PM: 06_30291.jpg (ID = 0)
3:39 PM: 07_29504.jpg (ID = 0)
3:39 PM: 08_32179.jpg (ID = 0)
3:39 PM: 09_28688.jpg (ID = 0)
3:39 PM: 10_29651.jpg (ID = 0)
3:39 PM: 11_31105.jpg (ID = 0)
3:39 PM: 14_26426.jpg (ID = 0)
3:39 PM: 15_25544.jpg (ID = 0)
3:39 PM: 16_28163.jpg (ID = 0)
3:39 PM: 17_35087.jpg (ID = 0)
3:39 PM: 18_30053.jpg (ID = 0)
3:39 PM: teenie01.jpg (ID = 0)
3:39 PM: teenie02.jpg (ID = 0)
3:39 PM: teenie03.jpg (ID = 0)
3:39 PM: teenie04.jpg (ID = 0)
3:39 PM: teenie05.jpg (ID = 0)
3:39 PM: teenie07.jpg (ID = 0)
3:39 PM: teenie08.jpg (ID = 0)
3:39 PM: teenie09.jpg (ID = 0)
3:39 PM: teenie11.jpg (ID = 0)
3:39 PM: teenie16.jpg (ID = 0)
3:39 PM: 01.jpg (ID = 0)
3:39 PM: 12.jpg (ID = 0)
3:39 PM: 14.jpg (ID = 0)
3:39 PM: zbthumbnail.info (ID = 0)
3:39 PM: 003.jpg (ID = 0)
3:39 PM: 008.jpg (ID = 0)
3:39 PM: 014.jpg (ID = 0)
3:39 PM: zbthumbnail.info (ID = 0)
3:39 PM: zaneta~7.jpg (ID = 0)
3:39 PM: image1.jpg (ID = 0)
3:39 PM: image10.jpg (ID = 0)
3:39 PM: image11.jpg (ID = 0)
3:39 PM: image12.jpg (ID = 0)
3:39 PM: image13.jpg (ID = 0)
3:39 PM: image14.jpg (ID = 0)
3:39 PM: image15.jpg (ID = 0)
3:39 PM: image16.jpg (ID = 0)
3:39 PM: image17.jpg (ID = 0)
3:39 PM: image18.jpg (ID = 0)
3:39 PM: image2.jpg (ID = 0)
3:39 PM: image20.jpg (ID = 0)
3:39 PM: image3.jpg (ID = 0)
3:39 PM: image4.jpg (ID = 0)
3:39 PM: image5.jpg (ID = 0)
3:39 PM: image6.jpg (ID = 0)
3:39 PM: image7.jpg (ID = 0)
3:39 PM: image8.jpg (ID = 0)
3:39 PM: image9.jpg (ID = 0)
3:39 PM: 001.jpg (ID = 0)
3:39 PM: 002.jpg (ID = 0)
3:39 PM: 003.jpg (ID = 0)
3:39 PM: 004.jpg (ID = 0)
3:39 PM: 005.jpg (ID = 0)
3:39 PM: 006.jpg (ID = 0)
3:39 PM: 007.jpg (ID = 0)
3:39 PM: 008.jpg (ID = 0)
3:39 PM: 009.jpg (ID = 0)
3:39 PM: 010.jpg (ID = 0)
3:39 PM: 011.jpg (ID = 0)
3:39 PM: 012.jpg (ID = 0)
3:39 PM: 013.jpg (ID = 0)
3:39 PM: 014.jpg (ID = 0)
3:39 PM: 015.jpg (ID = 0)
3:39 PM: 016.jpg (ID = 0)
3:39 PM: 017.jpg (ID = 0)
3:39 PM: 018.jpg (ID = 0)
3:39 PM: 019.jpg (ID = 0)
3:39 PM: 020.jpg (ID = 0)
3:39 PM: 0069.jpg (ID = 0)
3:39 PM: 13-1.jpg (ID = 0)
3:39 PM: 19x-001.jpg (ID = 0)
3:39 PM: 19x-0011.jpg (ID = 0)
3:39 PM: 19x-007.jpg (ID = 0)
3:39 PM: 19x-008.jpg (ID = 0)
3:39 PM: 19x-011.jpg (ID = 0)
3:39 PM: 19x-012.jpg (ID = 0)
3:39 PM: 19x-013.jpg (ID = 0)
3:39 PM: 19x-015-1.jpg (ID = 0)
3:39 PM: 19x-016-1.jpg (ID = 0)
3:39 PM: 19x-124.jpg (ID = 0)
3:39 PM: 19x-125.jpg (ID = 0)
3:39 PM: 19x-126.jpg (ID = 0)
3:39 PM: 19x-127.jpg (ID = 0)
3:39 PM: 19x-128.jpg (ID = 0)
3:39 PM: 19x-129.jpg (ID = 0)
3:39 PM: 19x-130.jpg (ID = 0)
3:39 PM: 19x-131.jpg (ID = 0)
3:39 PM: 19x-132.jpg (ID = 0)
3:39 PM: 19x-133.jpg (ID = 0)
3:39 PM: 19x-135.jpg (ID = 0)
3:39 PM: zaneta~1.jpg (ID = 0)
3:39 PM: zaneta~2.jpg (ID = 0)
3:39 PM: zaneta~3.jpg (ID = 0)
3:39 PM: zaneta~4.jpg (ID = 0)
3:39 PM: zaneta~5.jpg (ID = 0)
3:39 PM: zaneta~6.jpg (ID = 0)
3:39 PM: 07.jpg (ID = 0)
3:39 PM: teenie01.jpg (ID = 0)
3:39 PM: teenie02.jpg (ID = 0)
3:39 PM: teenie03.jpg (ID = 0)
3:39 PM: teenie04.jpg (ID = 0)
3:39 PM: teenie05.jpg (ID = 0)
3:39 PM: teenie06.jpg (ID = 0)
3:39 PM: teenie07.jpg (ID = 0)
3:39 PM: teenie08.jpg (ID = 0)
3:39 PM: teenie09.jpg (ID = 0)
3:39 PM: teenie10.jpg (ID = 0)
3:39 PM: teenie11.jpg (ID = 0)
3:39 PM: teenie12.jpg (ID = 0)
3:39 PM: teenie13.jpg (ID = 0)
3:39 PM: teenie14.jpg (ID = 0)
3:39 PM: teenie15.jpg (ID = 0)
3:39 PM: teenie16.jpg (ID = 0)
3:39 PM: lrg01.jpg (ID = 0)
3:39 PM: lrg02.jpg (ID = 0)
3:39 PM: lrg03.jpg (ID = 0)
3:39 PM: lrg04.jpg (ID = 0)
3:39 PM: lrg05.jpg (ID = 0)
3:39 PM: lrg06.jpg (ID = 0)
3:39 PM: lrg07.jpg (ID = 0)
3:39 PM: lrg08.jpg (ID = 0)
3:39 PM: lrg09.jpg (ID = 0)
3:39 PM: lrg10.jpg (ID = 0)
3:39 PM: lrg11.jpg (ID = 0)
3:39 PM: lrg12.jpg (ID = 0)
3:39 PM: lrg13.jpg (ID = 0)
3:39 PM: lrg14.jpg (ID = 0)
3:39 PM: lrg15.jpg (ID = 0)
3:39 PM: lrg16.jpg (ID = 0)
3:39 PM: lrg17.jpg (ID = 0)
3:39 PM: 1531.jpg (ID = 0)
3:39 PM: 15310.jpg (ID = 0)
3:39 PM: 15311.jpg (ID = 0)
3:39 PM: 15316.jpg (ID = 0)
3:39 PM: 1532.jpg (ID = 0)
3:39 PM: 1535.jpg (ID = 0)
3:39 PM: 1536.jpg (ID = 0)
3:39 PM: 1537.jpg (ID = 0)
3:39 PM: 1538.jpg (ID = 0)
3:39 PM: 1539.jpg (ID = 0)
3:39 PM: pic01.jpg (ID = 0)
3:39 PM: pic02.jpg (ID = 0)
3:39 PM: pic03.jpg (ID = 0)
3:39 PM: pic04.jpg (ID = 0)
3:39 PM: pic05.jpg (ID = 0)
3:39 PM: pic06.jpg (ID = 0)
3:39 PM: pic07.jpg (ID = 0)
3:39 PM: pic08.jpg (ID = 0)
3:39 PM: pic09.jpg (ID = 0)
3:39 PM: pic10.jpg (ID = 0)
3:39 PM: pic11.jpg (ID = 0)
3:39 PM: pic12.jpg (ID = 0)
3:39 PM: pic13.jpg (ID = 0)
3:39 PM: pic14.jpg (ID = 0)
3:39 PM: pic15.jpg (ID = 0)
3:39 PM: pic16.jpg (ID = 0)
3:39 PM: pic17.jpg (ID = 0)
CONT>>>>>>>

Edited by redghia, 05 November 2005 - 02:14 AM.

[redghia]

3:39 PM: pic18.jpg (ID = 0)
3:39 PM: 002.jpg (ID = 0)
3:39 PM: 003.jpg (ID = 0)
3:39 PM: 004.jpg (ID = 0)
3:39 PM: 005.jpg (ID = 0)
3:39 PM: 006.jpg (ID = 0)
3:39 PM: 007.jpg (ID = 0)
3:39 PM: 008.jpg (ID = 0)
3:39 PM: 009.jpg (ID = 0)
3:39 PM: 010.jpg (ID = 0)
3:39 PM: 011.jpg (ID = 0)
3:39 PM: 012.jpg (ID = 0)
3:39 PM: 013.jpg (ID = 0)
3:39 PM: 014.jpg (ID = 0)
3:39 PM: 015.jpg (ID = 0)
3:39 PM: 016.jpg (ID = 0)
3:39 PM: 017.jpg (ID = 0)
3:39 PM: 018.jpg (ID = 0)
3:39 PM: 019.jpg (ID = 0)
3:39 PM: 020.jpg (ID = 0)
3:39 PM: 021.jpg (ID = 0)
3:39 PM: 022.jpg (ID = 0)
3:39 PM: 023.jpg (ID = 0)
3:39 PM: 024.jpg (ID = 0)
3:39 PM: aly004-010_jpg.jpg (ID = 0)
3:39 PM: aly004-012_jpg.jpg (ID = 0)
3:39 PM: aly004-023_jpg.jpg (ID = 0)
3:39 PM: aly004-030_jpg.jpg (ID = 0)
3:39 PM: aly004-032_jpg.jpg (ID = 0)
3:39 PM: aly004-037_jpg.jpg (ID = 0)
3:39 PM: aly004-040_jpg.jpg (ID = 0)
3:39 PM: aly004-042_jpg.jpg (ID = 0)
3:39 PM: 001.jpg (ID = 0)
3:39 PM: 002.jpg (ID = 0)
3:39 PM: 003.jpg (ID = 0)
3:39 PM: 004.jpg (ID = 0)
3:39 PM: 005.jpg (ID = 0)
3:39 PM: 006.jpg (ID = 0)
3:39 PM: 007.jpg (ID = 0)
3:39 PM: 008.jpg (ID = 0)
3:39 PM: 009.jpg (ID = 0)
3:39 PM: 010.jpg (ID = 0)
3:39 PM: 011.jpg (ID = 0)
3:39 PM: 012.jpg (ID = 0)
3:39 PM: 013.jpg (ID = 0)
3:39 PM: 014.jpg (ID = 0)
3:39 PM: 017.jpg (ID = 0)
3:39 PM: 018.jpg (ID = 0)
3:39 PM: 019.jpg (ID = 0)
3:39 PM: 01.jpg (ID = 0)
3:39 PM: 05.jpg (ID = 0)
3:39 PM: 07.jpg (ID = 0)
3:39 PM: 08.jpg (ID = 0)
3:39 PM: 15.jpg (ID = 0)
3:39 PM: 01.jpg (ID = 0)
3:39 PM: 02.jpg (ID = 0)
3:39 PM: 04.jpg (ID = 0)
3:39 PM: 05.jpg (ID = 0)
3:39 PM: 08.jpg (ID = 0)
3:39 PM: 11.jpg (ID = 0)
3:39 PM: 13.jpg (ID = 0)
3:39 PM: 18.jpg (ID = 0)
3:39 PM: kinou041.jpg (ID = 0)
3:39 PM: kinou042.jpg (ID = 0)
3:39 PM: kinou046.jpg (ID = 0)
3:39 PM: kinou054.jpg (ID = 0)
3:39 PM: kinou063.jpg (ID = 0)
3:39 PM: kinou072.jpg (ID = 0)
3:39 PM: pic02.jpg (ID = 0)
3:39 PM: pic04.jpg (ID = 0)
3:39 PM: pic10.jpg (ID = 0)
3:39 PM: zbthumbnail.info (ID = 0)
3:39 PM: 1.jpg (ID = 0)
3:39 PM: 10.jpg (ID = 0)
3:39 PM: 11.jpg (ID = 0)
3:39 PM: 12.jpg (ID = 0)
3:39 PM: 13.jpg (ID = 0)
3:39 PM: 14.jpg (ID = 0)
3:39 PM: 15.jpg (ID = 0)
3:39 PM: 2.jpg (ID = 0)
3:39 PM: 3.jpg (ID = 0)
3:39 PM: 4.jpg (ID = 0)
3:39 PM: 5.jpg (ID = 0)
3:39 PM: 6.jpg (ID = 0)
3:39 PM: 7.jpg (ID = 0)
3:39 PM: 8.jpg (ID = 0)
3:39 PM: 9.jpg (ID = 0)
3:39 PM: brittany113.jpg (ID = 0)
3:39 PM: brittany114.jpg (ID = 0)
3:39 PM: brittany117.jpg (ID = 0)
3:39 PM: brittany122.jpg (ID = 0)
3:39 PM: brittany125.jpg (ID = 0)
3:39 PM: brittany126.jpg (ID = 0)
3:39 PM: 001.jpg (ID = 0)
3:39 PM: 002.jpg (ID = 0)
3:39 PM: 003.jpg (ID = 0)
3:39 PM: 011.jpg (ID = 0)
3:39 PM: 014.jpg (ID = 0)
3:39 PM: 016.jpg (ID = 0)
3:39 PM: louisewi1001.jpg (ID = 0)
3:39 PM: louisewi1009.jpg (ID = 0)
3:39 PM: louisewi1023.jpg (ID = 0)
3:39 PM: louisewi1027.jpg (ID = 0)
3:39 PM: louisewi1029.jpg (ID = 0)
3:39 PM: louisewi1037.jpg (ID = 0)
3:39 PM: louisewi1043.jpg (ID = 0)
3:39 PM: louisewi1057.jpg (ID = 0)
3:39 PM: louisewi1059.jpg (ID = 0)
3:39 PM: louisewi1065.jpg (ID = 0)
3:39 PM: louisewi1070.jpg (ID = 0)
3:39 PM: louisewi1075.jpg (ID = 0)
3:39 PM: louisewi1079.jpg (ID = 0)
3:39 PM: louisewi1084.jpg (ID = 0)
3:39 PM: louisewi1101.jpg (ID = 0)
3:39 PM: louisewi1102.jpg (ID = 0)
3:39 PM: louisewi1105.jpg (ID = 0)
3:39 PM: louisewi1108.jpg (ID = 0)
3:39 PM: louisewi1109.jpg (ID = 0)
3:39 PM: louisewi1112.jpg (ID = 0)
3:39 PM: reese001.jpg (ID = 0)
3:39 PM: reese002.jpg (ID = 0)
3:39 PM: reese003.jpg (ID = 0)
3:39 PM: reese004.jpg (ID = 0)
3:39 PM: reese005.jpg (ID = 0)
3:39 PM: reese006.jpg (ID = 0)
3:39 PM: reese007.jpg (ID = 0)
3:39 PM: reese008.jpg (ID = 0)
3:39 PM: reese009.jpg (ID = 0)
3:39 PM: reese010.jpg (ID = 0)
3:39 PM: reese011.jpg (ID = 0)
3:39 PM: reese012.jpg (ID = 0)
3:39 PM: reese013.jpg (ID = 0)
3:39 PM: reese014.jpg (ID = 0)
3:39 PM: reese015.jpg (ID = 0)
3:39 PM: reese016.jpg (ID = 0)
3:39 PM: reese017.jpg (ID = 0)
3:39 PM: reese018.jpg (ID = 0)
3:39 PM: reese019.jpg (ID = 0)
3:39 PM: reese020.jpg (ID = 0)
3:39 PM: reese021.jpg (ID = 0)
3:39 PM: reese022.jpg (ID = 0)
3:39 PM: reese023.jpg (ID = 0)
3:39 PM: reese024.jpg (ID = 0)
3:39 PM: reese025.jpg (ID = 0)
3:39 PM: reese026.jpg (ID = 0)
3:39 PM: reese027.jpg (ID = 0)
3:39 PM: reese035.jpg (ID = 0)
3:39 PM: reese036.jpg (ID = 0)
3:39 PM: reese037.jpg (ID = 0)
3:39 PM: reese038.jpg (ID = 0)
3:39 PM: reese039.jpg (ID = 0)
3:39 PM: reese052.jpg (ID = 0)
3:39 PM: reese070.jpg (ID = 0)
3:39 PM: reese080.jpg (ID = 0)
3:39 PM: 10big.jpg (ID = 0)
3:39 PM: 16big.jpg (ID = 0)
3:39 PM: 19big.jpg (ID = 0)
3:39 PM: 1big.jpg (ID = 0)
3:39 PM: 2big.jpg (ID = 0)
3:39 PM: 4big.jpg (ID = 0)
3:39 PM: 6big.jpg (ID = 0)
3:39 PM: 7big.jpg (ID = 0)
3:39 PM: pic01.jpg (ID = 0)
3:39 PM: pic03.jpg (ID = 0)
3:39 PM: pic04.jpg (ID = 0)
3:39 PM: pic06.jpg (ID = 0)
3:39 PM: pic07.jpg (ID = 0)
3:39 PM: pic09.jpg (ID = 0)
3:39 PM: pic12.jpg (ID = 0)
3:39 PM: pic15.jpg (ID = 0)
3:39 PM: pic20.jpg (ID = 0)
3:39 PM: aly01.jpg (ID = 0)
3:39 PM: aly02.jpg (ID = 0)
3:39 PM: aly03.jpg (ID = 0)
3:39 PM: aly04.jpg (ID = 0)
3:39 PM: aly05.jpg (ID = 0)
3:39 PM: aly06.jpg (ID = 0)
3:39 PM: aly07.jpg (ID = 0)
3:39 PM: aly08.jpg (ID = 0)
3:39 PM: aly10.jpg (ID = 0)
3:39 PM: aly11.jpg (ID = 0)
3:39 PM: aly12.jpg (ID = 0)
3:39 PM: aly13.jpg (ID = 0)
3:39 PM: b01.jpg (ID = 0)
3:39 PM: b02.jpg (ID = 0)
3:39 PM: b03.jpg (ID = 0)
3:39 PM: b04.jpg (ID = 0)
3:39 PM: b05.jpg (ID = 0)
3:39 PM: b07.jpg (ID = 0)
3:39 PM: b10.jpg (ID = 0)
3:39 PM: b12.jpg (ID = 0)
3:39 PM: avg01.jpg (ID = 0)
3:39 PM: avg04.jpg (ID = 0)
3:39 PM: avg05.jpg (ID = 0)
3:39 PM: avg10.jpg (ID = 0)
3:39 PM: avg11.jpg (ID = 0)
3:39 PM: avg15.jpg (ID = 0)
3:39 PM: avg16.jpg (ID = 0)
3:39 PM: avg20.jpg (ID = 0)
3:39 PM: 04.jpg (ID = 0)
3:39 PM: stacy-bride-01.jpg (ID = 0)
3:39 PM: stacy-bride-02.jpg (ID = 0)
3:39 PM: stacy-bride-03.jpg (ID = 0)
3:39 PM: stacy-bride-04.jpg (ID = 0)
3:39 PM: stacy-bride-09.jpg (ID = 0)
3:39 PM: stacy-bride-12.jpg (ID = 0)
3:39 PM: stacy-bride-13.jpg (ID = 0)
3:39 PM: stacy-bride-15.jpg (ID = 0)
3:39 PM: stacy-bride-16.jpg (ID = 0)
3:39 PM: thumbs.db (ID = 0)
3:39 PM: b01.jpg (ID = 0)
3:40 PM: b07.jpg (ID = 0)
3:40 PM: b10.jpg (ID = 0)
3:40 PM: o-sexy-corset-01.jpg (ID = 0)
3:40 PM: o-sexy-corset-02.jpg (ID = 0)
3:40 PM: o-sexy-corset-03.jpg (ID = 0)
3:40 PM: o-sexy-corset-04.jpg (ID = 0)
3:40 PM: o-sexy-corset-05.jpg (ID = 0)
3:40 PM: o-sexy-corset-06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 6.jpg (ID = 0)
3:40 PM: picture%20083.jpg (ID = 0)
3:40 PM: picture%20086.jpg (ID = 0)
3:40 PM: picture%20091.jpg (ID = 0)
3:40 PM: picture%20092.jpg (ID = 0)
3:40 PM: picture%20095.jpg (ID = 0)
3:40 PM: picture%20099.jpg (ID = 0)
3:40 PM: picture%20100.jpg (ID = 0)
3:40 PM: picture%20112.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 18.jpg (ID = 0)
3:40 PM: thumbs.db (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 6.jpg (ID = 0)
3:40 PM: 9.jpg (ID = 0)
3:40 PM: ebina0006.jpg (ID = 0)
3:40 PM: ebina0010.jpg (ID = 0)
3:40 PM: ebina0012.jpg (ID = 0)
3:40 PM: ebina0013.jpg (ID = 0)
3:40 PM: ebina0015.jpg (ID = 0)
3:40 PM: thumbs.db (ID = 0)
3:40 PM: p09.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 2.jpg (ID = 0)
3:40 PM: 5.jpg (ID = 0)
3:40 PM: 6.jpg (ID = 0)
3:40 PM: 7.jpg (ID = 0)
3:40 PM: thumbs.db (ID = 0)
3:40 PM: pic013.jpg (ID = 0)
3:40 PM: pic016.jpg (ID = 0)
3:40 PM: pic034.jpg (ID = 0)
3:40 PM: pic037.jpg (ID = 0)
3:40 PM: pic043.jpg (ID = 0)
3:40 PM: thumbs.db (ID = 0)
3:40 PM: [bleep]ing-machine-01.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-02.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-03.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-04.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-05.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-06.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-07.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-08.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-09.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-10.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-11.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-12.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-13.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-14.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-15.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-16.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-17.jpg (ID = 0)
3:40 PM: [bleep]ing-machine-18.jpg (ID = 0)
3:40 PM: thumbs.db (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: dscf0199.jpg (ID = 0)
3:40 PM: dscf0206.jpg (ID = 0)
3:40 PM: dscf0214.jpg (ID = 0)
3:40 PM: dscf0241.jpg (ID = 0)
3:40 PM: dscf0252.jpg (ID = 0)
3:40 PM: dscf0267.jpg (ID = 0)
3:40 PM: dscf0306.jpg (ID = 0)
3:40 PM: thumbs.db (ID = 0)
3:40 PM: untitled.bmp (ID = 0)
3:40 PM: untitled1.bmp (ID = 0)
3:40 PM: untitled10.bmp (ID = 0)
3:40 PM: untitled11.bmp (ID = 0)
3:40 PM: untitled12.bmp (ID = 0)
3:40 PM: untitled13.bmp (ID = 0)
3:40 PM: untitled14.bmp (ID = 0)
3:40 PM: untitled15.bmp (ID = 0)
3:40 PM: untitled2.bmp (ID = 0)
3:40 PM: untitled3.bmp (ID = 0)
3:40 PM: untitled4.bmp (ID = 0)
3:40 PM: untitled5.bmp (ID = 0)
3:40 PM: untitled6.bmp (ID = 0)
3:40 PM: untitled7.bmp (ID = 0)
3:40 PM: untitled8.bmp (ID = 0)
3:40 PM: untitled9.bmp (ID = 0)
3:40 PM: p04.jpg (ID = 0)
3:40 PM: p05.jpg (ID = 0)
3:40 PM: p09.jpg (ID = 0)
3:40 PM: pic08.jpg (ID = 0)
3:40 PM: pic14.jpg (ID = 0)
3:40 PM: 040205001_jpg.jpg (ID = 0)
3:40 PM: 040205002_jpg.jpg (ID = 0)
3:40 PM: 040205004_jpg.jpg (ID = 0)
3:40 PM: 040205005_jpg.jpg (ID = 0)
3:40 PM: 040205006_jpg.jpg (ID = 0)
3:40 PM: 040205007_jpg.jpg (ID = 0)
3:40 PM: 040205008_jpg.jpg (ID = 0)
3:40 PM: 040205009_jpg.jpg (ID = 0)
3:40 PM: 040205015_jpg.jpg (ID = 0)
3:40 PM: 040205023_jpg.jpg (ID = 0)
3:40 PM: 040205024_jpg.jpg (ID = 0)
3:40 PM: 040205025_jpg.jpg (ID = 0)
3:40 PM: 040205026_jpg.jpg (ID = 0)
3:40 PM: 040205031_jpg.jpg (ID = 0)
3:40 PM: 040205034_jpg.jpg (ID = 0)
3:40 PM: 040205039_jpg.jpg (ID = 0)
3:40 PM: dana-036.jpg (ID = 0)
3:40 PM: dana-038.jpg (ID = 0)
3:40 PM: dana-047.jpg (ID = 0)
3:40 PM: dana-057.jpg (ID = 0)
3:40 PM: dana-058.jpg (ID = 0)
3:40 PM: dana-081.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 17.jpg (ID = 0)
3:40 PM: passion1.jpg (ID = 0)
3:40 PM: passion10.jpg (ID = 0)
3:40 PM: passion12.jpg (ID = 0)
3:40 PM: passion16.jpg (ID = 0)
3:40 PM: passion3.jpg (ID = 0)
3:40 PM: passion4.jpg (ID = 0)
3:40 PM: passion8.jpg (ID = 0)
3:40 PM: f11.jpg (ID = 0)
3:40 PM: f24.jpg (ID = 0)
3:40 PM: f36.jpg (ID = 0)
3:40 PM: f4.jpg (ID = 0)
3:40 PM: f52.jpg (ID = 0)
3:40 PM: f64.jpg (ID = 0)
3:40 PM: f7.jpg (ID = 0)
3:40 PM: redhead10.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 3.jpg (ID = 0)
3:40 PM: 6.jpg (ID = 0)
3:40 PM: 9.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 5.jpg (ID = 0)
3:40 PM: 7.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 2.jpg (ID = 0)
3:40 PM: 3.jpg (ID = 0)
3:40 PM: 4.jpg (ID = 0)
3:40 PM: 6.jpg (ID = 0)
3:40 PM: 7.jpg (ID = 0)
3:40 PM: 9.jpg (ID = 0)
3:40 PM: tfc031_003.jpg (ID = 0)
3:40 PM: tfc031_008.jpg (ID = 0)
3:40 PM: tfc031_015.jpg (ID = 0)
3:40 PM: tfc031_073.jpg (ID = 0)
3:40 PM: tfc031_092.jpg (ID = 0)
3:40 PM: tfc031_102.jpg (ID = 0)
3:40 PM: tfc031_114.jpg (ID = 0)
3:40 PM: b1.jpg (ID = 0)
3:40 PM: b10.jpg (ID = 0)
3:40 PM: b11.jpg (ID = 0)
3:40 PM: b12.jpg (ID = 0)
3:40 PM: b13.jpg (ID = 0)
3:40 PM: b14.jpg (ID = 0)
3:40 PM: b15.jpg (ID = 0)
3:40 PM: b16.jpg (ID = 0)
3:40 PM: b17.jpg (ID = 0)
3:40 PM: b18.jpg (ID = 0)
3:40 PM: b19.jpg (ID = 0)
3:40 PM: b2.jpg (ID = 0)
3:40 PM: b20.jpg (ID = 0)
3:40 PM: b3.jpg (ID = 0)
3:40 PM: b4.jpg (ID = 0)
3:40 PM: b5.jpg (ID = 0)
3:40 PM: b6.jpg (ID = 0)
3:40 PM: b7.jpg (ID = 0)
3:40 PM: b8.jpg (ID = 0)
3:40 PM: b9.jpg (ID = 0)
3:40 PM: 045.jpg (ID = 0)
3:40 PM: 071.jpg (ID = 0)
3:40 PM: 073.jpg (ID = 0)
3:40 PM: 075.jpg (ID = 0)
3:40 PM: 076.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: image04.jpg (ID = 0)
3:40 PM: image05.jpg (ID = 0)
3:40 PM: image06.jpg (ID = 0)
3:40 PM: image07.jpg (ID = 0)
3:40 PM: image08.jpg (ID = 0)
3:40 PM: image09.jpg (ID = 0)
3:40 PM: image10.jpg (ID = 0)
3:40 PM: image11.jpg (ID = 0)
3:40 PM: image12.jpg (ID = 0)
3:40 PM: image16.jpg (ID = 0)
3:40 PM: pic14.jpg (ID = 0)
3:40 PM: pic15.jpg (ID = 0)
3:40 PM: pic16.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: jeng2000.jpg (ID = 0)
3:40 PM: jeng2001.jpg (ID = 0)
3:40 PM: jeng2008.jpg (ID = 0)
3:40 PM: jeng2012.jpg (ID = 0)
3:40 PM: jeng2020.jpg (ID = 0)
3:40 PM: jeng2026.jpg (ID = 0)
3:40 PM: jeng2034.jpg (ID = 0)
3:40 PM: jeng2036.jpg (ID = 0)
3:40 PM: jeng2045.jpg (ID = 0)
3:40 PM: jeng2058.jpg (ID = 0)
3:40 PM: jeng2067.jpg (ID = 0)
3:40 PM: jeng2069.jpg (ID = 0)
3:40 PM: jeng2078.jpg (ID = 0)
3:40 PM: jeng2079.jpg (ID = 0)
3:40 PM: jeng2080.jpg (ID = 0)
3:40 PM: pp01.jpg (ID = 0)
3:40 PM: pp02.jpg (ID = 0)
3:40 PM: pp06.jpg (ID = 0)
3:40 PM: pp12.jpg (ID = 0)
3:40 PM: pp13.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 2.jpg (ID = 0)
3:40 PM: 3.jpg (ID = 0)
3:40 PM: 4.jpg (ID = 0)
3:40 PM: 5.jpg (ID = 0)
3:40 PM: 6.jpg (ID = 0)
3:40 PM: 7.jpg (ID = 0)
3:40 PM: 8.jpg (ID = 0)
3:40 PM: 9.jpg (ID = 0)
3:40 PM: 016.jpg (ID = 0)
3:40 PM: 020.jpg (ID = 0)
3:40 PM: 021.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: pk09p.jpg (ID = 0)
3:40 PM: pk10p.jpg (ID = 0)
3:40 PM: pk11p.jpg (ID = 0)
3:40 PM: pk12p.jpg (ID = 0)
3:40 PM: pk13p.jpg (ID = 0)
3:40 PM: pk15p.jpg (ID = 0)
3:40 PM: pk16p.jpg (ID = 0)
3:40 PM: pk17p.jpg (ID = 0)
3:40 PM: pk18p.jpg (ID = 0)
3:40 PM: pk20p.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 17.jpg (ID = 0)
3:40 PM: 18.jpg (ID = 0)
3:40 PM: 19.jpg (ID = 0)
3:40 PM: 20.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: dsc00069.jpg (ID = 0)
3:40 PM: dsc00071.jpg (ID = 0)
3:40 PM: dsc00082.jpg (ID = 0)
3:40 PM: dsc00083.jpg (ID = 0)
3:40 PM: dsc00084.jpg (ID = 0)
3:40 PM: dsc00105.jpg (ID = 0)
3:40 PM: dsc00107.jpg (ID = 0)
3:40 PM: dsc00108.jpg (ID = 0)
3:40 PM: dsc00109.jpg (ID = 0)
3:40 PM: dsc00111.jpg (ID = 0)
3:40 PM: dsc00114.jpg (ID = 0)
3:40 PM: dsc00115.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: teen01.jpg (ID = 0)
3:40 PM: teen02.jpg (ID = 0)
3:40 PM: teen03.jpg (ID = 0)
3:40 PM: teen04.jpg (ID = 0)
3:40 PM: teen05.jpg (ID = 0)
3:40 PM: teen06.jpg (ID = 0)
3:40 PM: teen07.jpg (ID = 0)
3:40 PM: teen08.jpg (ID = 0)
3:40 PM: teen09.jpg (ID = 0)
3:40 PM: teen10.jpg (ID = 0)
3:40 PM: teen11.jpg (ID = 0)
3:40 PM: teen12.jpg (ID = 0)
3:40 PM: teen13.jpg (ID = 0)
3:40 PM: teen14.jpg (ID = 0)
3:40 PM: teen15.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 2.jpg (ID = 0)
3:40 PM: 3.jpg (ID = 0)
3:40 PM: 4.jpg (ID = 0)
3:40 PM: 5.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 2.jpg (ID = 0)
3:40 PM: 3.jpg (ID = 0)
3:40 PM: 4.jpg (ID = 0)
3:40 PM: 5.jpg (ID = 0)
3:40 PM: 9.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-099.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-105.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-108.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-129.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-138.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-139.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-143.jpg (ID = 0)
3:40 PM: amber-michaels-anal-sex-146.jpg (ID = 0)
3:40 PM: 501.jpg (ID = 0)
3:40 PM: 502.jpg (ID = 0)
3:40 PM: 503.jpg (ID = 0)
3:40 PM: 504.jpg (ID = 0)
3:40 PM: 505.jpg (ID = 0)
3:40 PM: 506.jpg (ID = 0)
3:40 PM: 507.jpg (ID = 0)
3:40 PM: 508.jpg (ID = 0)
3:40 PM: 509.jpg (ID = 0)
3:40 PM: 510.jpg (ID = 0)
3:40 PM: 511.jpg (ID = 0)
3:40 PM: 512.jpg (ID = 0)
3:40 PM: 513.jpg (ID = 0)
3:40 PM: 514.jpg (ID = 0)
3:40 PM: 515.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 095009.jpg (ID = 0)
3:40 PM: 095011.jpg (ID = 0)
3:40 PM: 095012.jpg (ID = 0)
3:40 PM: 095015.jpg (ID = 0)
3:40 PM: 095c03.jpg (ID = 0)
3:40 PM: 095d008.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 2.jpg (ID = 0)
3:40 PM: 3.jpg (ID = 0)
3:40 PM: 4.jpg (ID = 0)
3:40 PM: 5.jpg (ID = 0)
3:40 PM: 6.jpg (ID = 0)
3:40 PM: 7.jpg (ID = 0)
3:40 PM: 8.jpg (ID = 0)
3:40 PM: 9.jpg (ID = 0)
3:40 PM: busty01.jpg (ID = 0)
3:40 PM: busty03.jpg (ID = 0)
3:40 PM: busty10.jpg (ID = 0)
3:40 PM: busty13.jpg (ID = 0)
3:40 PM: jennyeuro10.jpg (ID = 0)
3:40 PM: jennyeuro11.jpg (ID = 0)
3:40 PM: jennyeuro12.jpg (ID = 0)
3:40 PM: jennyeuro13.jpg (ID = 0)
3:40 PM: jennyeuro14.jpg (ID = 0)
3:40 PM: jennyeuro15.jpg (ID = 0)
3:40 PM: jennyeuro16.jpg (ID = 0)
3:40 PM: jennyeuro2.jpg (ID = 0)
3:40 PM: jennyeuro3.jpg (ID = 0)
3:40 PM: jennyeuro4.jpg (ID = 0)
3:40 PM: jennyeuro5.jpg (ID = 0)
3:40 PM: jennyeuro6.jpg (ID = 0)
3:40 PM: jennyeuro7.jpg (ID = 0)
3:40 PM: jennyeuro8.jpg (ID = 0)
3:40 PM: jennyeuro9.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 07.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 06.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 01.jpg (ID = 0)
3:40 PM: 02.jpg (ID = 0)
3:40 PM: 03.jpg (ID = 0)
3:40 PM: 04.jpg (ID = 0)
3:40 PM: 05.jpg (ID = 0)
3:40 PM: 08.jpg (ID = 0)
3:40 PM: 09.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 16.jpg (ID = 0)
3:40 PM: 1.jpg (ID = 0)
3:40 PM: 10.jpg (ID = 0)
3:40 PM: 11.jpg (ID = 0)
3:40 PM: 12.jpg (ID = 0)
3:40 PM: 13.jpg (ID = 0)
3:40 PM: 14.jpg (ID = 0)
3:40 PM: teen09.jpg (ID = 0)
3:40 PM: 15.jpg (ID = 0)
3:40 PM: 2.jpg (ID = 0)
3:40 PM: 3.jpg (ID = 0)
3:41 PM: 4.jpg (ID = 0)
3:41 PM: 5.jpg (ID = 0)
3:41 PM: 6.jpg (ID = 0)
3:41 PM: 7.jpg (ID = 0)
3:41 PM: 8.jpg (ID = 0)
3:41 PM: 9.jpg (ID = 0)
3:41 PM: 01.jpg (ID = 0)
3:41 PM: 02.jpg (ID = 0)
3:41 PM: 03.jpg (ID = 0)
3:41 PM: 04.jpg (ID = 0)
3:41 PM: 05.jpg (ID = 0)
3:41 PM: 06.jpg (ID = 0)
3:41 PM: 07.jpg (ID = 0)
3:41 PM: 08.jpg (ID = 0)
3:41 PM: 09.jpg (ID = 0)
3:41 PM: 10.jpg (ID = 0)
3:41 PM: 11.jpg (ID = 0)
3:41 PM: 12.jpg (ID = 0)
3:41 PM: 13.jpg (ID = 0)
3:41 PM: 14.jpg (ID = 0)
3:41 PM: 15.jpg (ID = 0)
3:41 PM: 01.jpg (ID = 0)
3:41 PM: 02.jpg (ID = 0)
3:41 PM: 03.jpg (ID = 0)
3:41 PM: 04.jpg (ID = 0)
3:41 PM: 05.jpg (ID = 0)
3:41 PM: 06.jpg (ID = 0)
3:41 PM: 08.jpg (ID = 0)
3:41 PM: 09.jpg (ID = 0)
3:41 PM: 10.jpg (ID = 0)
3:41 PM: 11.jpg (ID = 0)
3:41 PM: 12.jpg (ID = 0)
3:41 PM: 13.jpg (ID = 0)
3:41 PM: 14.jpg (ID = 0)
3:41 PM: 15.jpg (ID = 0)
3:41 PM: 16.jpg (ID = 0)
3:41 PM: large01.jpg (ID = 0)
3:41 PM: large02.jpg (ID = 0)
3:41 PM: large03.jpg (ID = 0)
3:41 PM: large04.jpg (ID = 0)
3:41 PM: large05.jpg (ID = 0)
3:41 PM: large06.jpg (ID = 0)
3:41 PM: large08.jpg (ID = 0)
3:41 PM: large12.jpg (ID = 0)
3:41 PM: large15.jpg (ID = 0)
3:41 PM: 01.jpg (ID = 0)
3:41 PM: 02.jpg (ID = 0)
3:41 PM: 03.jpg (ID = 0)
3:41 PM: 04.jpg (ID = 0)
3:41 PM: 05.jpg (ID = 0)
3:41 PM: 07.jpg (ID = 0)
3:41 PM: 08.jpg (ID = 0)
3:41 PM: 09.jpg (ID = 0)
3:41 PM: 10.jpg (ID = 0)
3:41 PM: natashahot12.jpg (ID = 0)
3:41 PM: natashahot14.jpg (ID = 0)
3:41 PM: natashahot2.jpg (ID = 0)
3:41 PM: natashahot9.jpg (ID = 0)
3:41 PM: 12.jpg (ID = 0)
3:41 PM: 16.jpg (ID = 0)
3:41 PM: pic13.jpg (ID = 0)
3:41 PM: 01.jpg (ID = 0)
3:41 PM: 07.jpg (ID = 0)
3:41 PM: 10.jpg (ID = 0)
3:41 PM: 16.jpg (ID = 0)
3:41 PM: 17.jpg (ID = 0)
3:41 PM: 18.jpg (ID = 0)
3:41 PM: 1.jpg (ID = 0)
3:41 PM: 2.jpg (ID = 0)
3:41 PM: 3.jpg (ID = 0)
3:41 PM: 5.jpg (ID = 0)
3:41 PM: 6.jpg (ID = 0)
3:41 PM: 001.jpg (ID = 0)
3:41 PM: 07.jpg (ID = 0)
3:41 PM: 15.jpg (ID = 0)
3:41 PM: angie1.jpg (ID = 0)
3:41 PM: angie12.jpg (ID = 0)
3:41 PM: angie16.jpg (ID = 0)
3:41 PM: angie2.jpg (ID = 0)
3:41 PM: kristinafey00112.jpg (ID = 0)
3:41 PM: kristinafey00115.jpg (ID = 0)
3:41 PM: kristinafey00122.jpg (ID = 0)
3:41 PM: kristinafey00123.jpg (ID = 0)
3:41 PM: kristinafey00124.jpg (ID = 0)
3:41 PM: kristinafey00127.jpg (ID = 0)
3:41 PM: kristinafey00128.jpg (ID = 0)
3:41 PM: kristinafey00131.jpg (ID = 0)
3:41 PM: kristinafey00132.jpg (ID = 0)
3:41 PM: kristinafey00134.jpg (ID = 0)
3:41 PM: kristinafey00135.jpg (ID = 0)
3:41 PM: kristinafey00158.jpg (ID = 0)
3:41 PM: kristinafey00183.jpg (ID = 0)
3:41 PM: kristinafey00193.jpg (ID = 0)
3:41 PM: kristinafey00238.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0754.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0756.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0762.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0764.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0770.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0776.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0779.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0780.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0786.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0787.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0789.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0791.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0793.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0800.jpg (ID = 0)
3:41 PM: anna_mills_fetish_0803.jpg (ID = 0)
3:41 PM: busty03.jpg (ID = 0)
3:41 PM: busty04.jpg (ID = 0)
3:41 PM: busty05.jpg (ID = 0)
3:41 PM: busty06.jpg (ID = 0)
3:41 PM: busty12.jpg (ID = 0)
3:41 PM: busty13.jpg (ID = 0)
3:41 PM: busty14.jpg (ID = 0)
3:41 PM: busty18.jpg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: kristin_76_004.jpg (ID = 0)
3:41 PM: 2.wmv (ID = 0)
3:41 PM: 1.wmv (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 4.mpeg (ID = 0)
3:41 PM: kristin66_01.jpg (ID = 0)
3:41 PM: kristin63_14.jpg (ID = 0)
3:41 PM: 7.jpg (ID = 0)
3:41 PM: 003.wmv (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: mpg04.wmv (ID = 0)
3:41 PM: mfx (ID = 0)
3:41 PM: bdwc_0005_1_1.mpeg (ID = 0)
3:41 PM: pc0140lb104.jpg (ID = 0)
3:41 PM: 1.jpg (ID = 0)
3:41 PM: 2.jpg (ID = 0)
3:41 PM: fta_casey_03.mpeg (ID = 0)
3:41 PM: 3-babewatch_7-set5.avi (ID = 0)
3:41 PM: 2.mpeg (ID = 0)
3:41 PM: strap-on-02.mpeg.3gp (ID = 0)
3:41 PM: 9.wmv (ID = 0)
3:41 PM: 02.jpg (ID = 0)
3:41 PM: 8.wmv (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 2.wmv (ID = 0)
3:41 PM: hfls005_007.wmv (ID = 0)
3:41 PM: hfls002_031.wmv (ID = 0)
3:41 PM: 9.jpg (ID = 0)
3:41 PM: 8.jpg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 1.jpg (ID = 0)
3:41 PM: 2.mpeg (ID = 0)
3:41 PM: nnanne08.jpg (ID = 0)
3:41 PM: kristin56_15.jpg (ID = 0)
3:41 PM: gl.hlp (ID = 0)
3:41 PM: ptroo024.jpg (ID = 0)
3:41 PM: clip09.mpeg (ID = 0)
3:41 PM: kristin56_07.jpg (ID = 0)
3:41 PM: mpg07.wmv (ID = 0)
3:41 PM: 07.jpg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 66.jpg (ID = 0)
3:41 PM: c1.mpeg (ID = 0)
3:41 PM: kristin70_01.jpg (ID = 0)
3:41 PM: attwinc.exe (ID = 0)
3:41 PM: clip08.mpeg (ID = 0)
3:41 PM: mpg17.wmv (ID = 0)
3:41 PM: invhdr.idx (ID = 0)
3:41 PM: 1..mpeg (ID = 0)
3:41 PM: ?.mpeg (ID = 0)
3:41 PM: 001.wmv (ID = 0)
3:41 PM: lesbian_0021_4_2.mpeg (ID = 0)
3:41 PM: mfx.sys (ID = 0)
3:41 PM: prodmast.dat (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: lesbian_0021_2_1.mpeg (ID = 0)
3:41 PM: kristin56_05.jpg (ID = 0)
3:41 PM: 1.mpeg (ID = 0)
3:41 PM: 01.wmv (ID = 0)
3:41 PM: kristin63_09.jpg (ID = 0)
3:41 PM: kristin66_15.jpg (ID = 0)
3:41 PM: kristin72_15.jpg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 01.wmv (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 01.mpeg (ID = 0)
3:41 PM: 03.wmv (ID = 0)
3:41 PM: 002.wmv (ID = 0)
3:41 PM: 12.jpg (ID = 0)
3:41 PM: mpg6.mpeg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 14.jpg (ID = 0)
3:41 PM: 04.wmv (ID = 0)
3:41 PM: kristin70_12.jpg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 7.jpg (ID = 0)
3:41 PM: 4hq.wmv (ID = 0)
3:41 PM: kristin56_09.jpg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 08_02.wmv (ID = 0)
3:41 PM: 2.mpeg (ID = 0)
3:41 PM: invdtl.idx (ID = 0)
3:41 PM: invhdr.dat (ID = 0)
3:41 PM: kristin_76_011.jpg (ID = 0)
3:41 PM: 08.mpeg (ID = 0)
3:41 PM: tlrh_tf_sm_chunk_bp.wmv (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 6.mpeg (ID = 0)
3:41 PM: 21.mpeg (ID = 0)
3:41 PM: nadine-04.wmv (ID = 0)
3:41 PM: 003.wmv (ID = 0)
3:41 PM: 3.mpeg (ID = 0)
3:41 PM: 5.mpeg (ID = 0)
3:41 PM: lesbian_0021_2_2.mpeg (ID = 0)
3:41 PM: kristin63_10.jpg (ID = 0)
3:41 PM: kristin63_01.jpg (ID = 0)
3:41 PM: 4..mpeg (ID = 0)
3:41 PM: 02.wmv (ID = 0)
3:41 PM: kristin63_05.jpg (ID = 0)
3:41 PM: 01.mpeg (ID = 0)
3:41 PM: 1.mpeg (ID = 0)
3:41 PM: 1151_m33.mpeg (ID = 0)
3:41 PM: 2.mpeg (ID = 0)
3:41 PM: 1176_m21.mpeg (ID = 0)
3:41 PM: 1176_m17.mpeg (ID = 0)
3:41 PM: 10.mpeg (ID = 0)
3:41 PM: lesbian_0021_4_1.mpeg (ID = 0)
3:41 PM: 03.mpeg (ID = 0)
3:41 PM: 6.wmv (ID = 0)
3:41 PM: 3..mpeg (ID = 0)
3:41 PM: 2.mpeg (ID = 0)
3:41 PM: 2..mpeg (ID = 0)
3:41 PM: kristin66_12.jpg (ID = 0)
3:41 PM: 001.mpeg (ID = 0)
3:41 PM: 1.mpeg (ID = 0)
3:41 PM: kristin63_06.jpg (ID = 0)
3:41 PM: 03.jpg (ID = 0)
3:41 PM: thumbs.db (ID = 0)
3:41 PM: 1.mpeg (ID = 0)
3:50 PM: File Sweep Complete, Elapsed Time: 00:35:13
3:50 PM: Full Sweep has completed. Elapsed time 00:37:30
3:50 PM: Traces Found: 41886
3:58 PM: Removal process initiated
3:58 PM: Quarantining All Traces: 180search assistant/zango
3:58 PM: Quarantining All Traces: directrevenue-abetterinternet
3:58 PM: Quarantining All Traces: isearch desktop search
3:58 PM: Quarantining All Traces: potentially rootkit-masked files
4:53 PM: Quarantining All Traces: blazefind
4:53 PM: Quarantining All Traces: hotbar
4:56 PM: Quarantining All Traces: marketscore
4:56 PM: Quarantining All Traces: starware toolbar
4:56 PM: Quarantining All Traces: trojan_backdoor_retro64
4:56 PM: Quarantining All Traces: deskad
4:56 PM: Quarantining All Traces: effective-i toolbar
4:56 PM: Quarantining All Traces: isearch toolbar
4:56 PM: Quarantining All Traces: screensavers
4:56 PM: Quarantining All Traces: searchbar toolbar
4:56 PM: Quarantining All Traces: secureads
4:56 PM: Quarantining All Traces: surf accuracy
4:56 PM: Quarantining All Traces: targetsaver
6:15 PM: Quarantining All Traces: webrebates
6:15 PM: Quarantining All Traces: whenu searchbar/pricebandit
6:15 PM: Quarantining All Traces: whenu
6:15 PM: Quarantining All Traces: winad
6:15 PM: Quarantining All Traces: 247realmedia cookie
6:15 PM: Quarantining All Traces: 3 cookie
6:15 PM: Quarantining All Traces: 4u.pl cookie
6:15 PM: Quarantining All Traces: 64.62.232 cookie
6:15 PM: Quarantining All Traces: 888 cookie
6:15 PM: Quarantining All Traces: about cookie
6:15 PM: Quarantining All Traces: accoona cookie
6:15 PM: Quarantining All Traces: adknowledge cookie
6:15 PM: Quarantining All Traces: ad-rotator cookie
6:15 PM: Quarantining All Traces: adserver cookie
6:15 PM: Quarantining All Traces: adultfriendfinder cookie
6:15 PM: Quarantining All Traces: ask cookie
6:15 PM: Quarantining All Traces: atlas dmt cookie
6:15 PM: Quarantining All Traces: azjmp cookie
6:15 PM: Quarantining All Traces: belnk cookie
6:15 PM: Quarantining All Traces: bizrate cookie
6:15 PM: Quarantining All Traces: burstbeacon cookie
6:15 PM: Quarantining All Traces: burstnet cookie
6:15 PM: Quarantining All Traces: cardomain cookie
6:15 PM: Quarantining All Traces: casalemedia cookie
6:15 PM: Quarantining All Traces: cassava cookie
6:15 PM: Quarantining All Traces: clicktracks cookie
6:15 PM: Quarantining All Traces: columbiahouse cookie
6:15 PM: Quarantining All Traces: cursorzone cookie
6:15 PM: Quarantining All Traces: dealtime cookie
6:15 PM: Quarantining All Traces: did-it cookie
6:15 PM: Quarantining All Traces: domain sponsor cookie
6:15 PM: Quarantining All Traces: fastclick cookie
6:15 PM: Quarantining All Traces: gamespy cookie
6:15 PM: Quarantining All Traces: gangbangsquad cookie
6:15 PM: Quarantining All Traces: go.com cookie
6:15 PM: Quarantining All Traces: go2net.com cookie
6:15 PM: Quarantining All Traces: hbmediapro cookie
6:15 PM: Quarantining All Traces: hitstats.net cookie
6:15 PM: Quarantining All Traces: hotbar cookie
6:15 PM: Quarantining All Traces: hypertracker.com cookie
6:15 PM: Quarantining All Traces: ic-live cookie
6:15 PM: Quarantining All Traces: infospace cookie
6:15 PM: Quarantining All Traces: maxserving cookie
6:15 PM: Quarantining All Traces: monstermarketplace cookie
6:15 PM: Quarantining All Traces: myaffiliateprogram.com cookie
6:15 PM: Quarantining All Traces: mycoolscreen cookie
6:15 PM: Quarantining All Traces: mywebsearch cookie
6:15 PM: Quarantining All Traces: nextag cookie
6:15 PM: Quarantining All Traces: overture cookie
6:15 PM: Quarantining All Traces: paypopup cookie
6:15 PM: Quarantining All Traces: pointroll cookie
6:15 PM: Quarantining All Traces: pricegrabber cookie
6:15 PM: Quarantining All Traces: primaryads cookie
6:15 PM: Quarantining All Traces: pro-market cookie
6:15 PM: Quarantining All Traces: questionmarket cookie
6:15 PM: Quarantining All Traces: reliablestats cookie
6:15 PM: Quarantining All Traces: rightmedia cookie
6:15 PM: Quarantining All Traces: rn11 cookie
6:15 PM: Quarantining All Traces: ru4 cookie
6:15 PM: Quarantining All Traces: screensavers.com cookie
6:15 PM: Quarantining All Traces: seeq cookie
6:15 PM: Quarantining All Traces: servlet cookie
6:15 PM: Quarantining All Traces: spywarestormer cookie
6:15 PM: Quarantining All Traces: starpulse cookie
6:15 PM: Quarantining All Traces: starware.com cookie
6:15 PM: Quarantining All Traces: statcounter cookie
6:15 PM: Quarantining All Traces: teensforcash cookie
6:15 PM: Quarantining All Traces: touchclarity cookie
6:15 PM: Quarantining All Traces: tracking cookie
6:15 PM: Quarantining All Traces: tradedoubler cookie
6:15 PM: Quarantining All Traces: tribalfusion cookie
6:15 PM: Quarantining All Traces: websponsors cookie
6:15 PM: Quarantining All Traces: web-stat cookie
6:15 PM: Quarantining All Traces: xiti cookie
6:15 PM: Quarantining All Traces: yadro cookie
6:15 PM: Quarantining All Traces: yieldmanager cookie
6:15 PM: Removal process completed. Elapsed time 02:16:56
********
3:12 PM: | Start of Session, Saturday, 5 November 2005 |
3:12 PM: Spy Sweeper started
3:12 PM: Sweep initiated using definitions version 567
3:12 PM: Starting Memory Sweep
3:12 PM: Sweep Canceled
3:12 PM: Memory Sweep Complete, Elapsed Time: 00:00:01
3:12 PM: Traces Found: 0
3:13 PM: | End of Session, Saturday, 5 November 2005 |
********
3:12 PM: | Start of Session, Saturday, 5 November 2005 |
3:12 PM: Spy Sweeper started

[redghia]

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\default]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mfrle32.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WebCheck]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\dn2801fue.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{9D40D638-613B-D136-DA60-19F06B3193A4}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device"
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device ContextMenuHandler"
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}"="Siemens SX1 PropertySheetHandler"
"{48F45200-91E6-11CE-8A4F-0080C81A28D4}"="TMD Shell Extension"
"{771A9DA0-731A-11CE-993C-00AA004ADB6C}"="VBPropSheet"
"{08625A55-6B3A-4109-88D8-56E8E333BB5E}"=""
"{E1322F09-02B6-4E72-B5CC-6B795E758A7B}"=""
"{FFF53BEF-BDA8-4AE2-8132-1ED35E97AD8C}"=""
"{52873B9C-4FB9-4D86-9A8F-80B81F2BB70D}"=""
"{5C9B06B7-04C7-4023-A090-A8008C37FABF}"=""
"{DAF11285-46F9-45A4-8383-F7A1EBE87E8F}"=""
"{A0BBE383-78E3-4C73-8128-1180B21D6A01}"=""
"{4683E64C-B125-495F-86F4-BFB5247CEDB8}"=""
"{E2CFB238-033C-429C-AEA0-4BFA6AF41BC9}"=""
"{EAA67C8D-5396-4ED9-9070-F1E9C30EB045}"=""
"{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension"
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{338A5538-4F3F-4DFE-8A14-E18D6E2EE8F1}"=""
"{5F98A4B6-CD25-42E8-81F2-2D6F392D1A84}"=""
"{ECDB9291-581E-441F-BBFB-A5DD3E73A550}"=""
"{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}"=""
"{F7F4E57E-2EBA-4123-903B-F1B85C40F791}"=""
"{E47953F8-125D-44A3-B6AF-B9C476F91E80}"=""
"{CD8D6C15-0BB8-4BDD-BA31-D79166660EEE}"=""
"{D3E9B3D1-22C7-4218-BA26-C0870B87441E}"=""
"{C25B7CF2-04EB-4FEF-BDD1-E937FC107EA2}"=""
"{8DF69A41-8595-4603-9687-17878366E970}"=""
"{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}"=""
"{90297BEE-CA79-485B-A504-50437C73BC1C}"=""
"{AADB38B6-0FCF-4658-B241-0768463432A2}"=""
"{CE85D680-9227-4EC0-9011-CF8F65BF9C69}"=""
"{40A0BE73-1DA1-47A9-964D-69207A2B5055}"=""
"{FAB9D278-019D-4BD0-AB48-B5DA18735547}"=""
"{2FF0E91F-F374-4285-8950-192EDE10110F}"=""
"{EEA42CC7-3814-4724-B055-1FD9177C68E5}"=""
"{031E5D37-227D-49F3-9FE0-20891140911F}"=""
"{22A4C29F-5E0D-472B-9A39-E558935E4219}"=""
"{77664C73-DC80-4D79-8150-062055E5FC8E}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\InprocServer32]
@="C:\\WINDOWS\\system32\\jxdw400.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\InprocServer32]
@="C:\\WINDOWS\\system32\\aqycfilt.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\InprocServer32]
@="C:\\WINDOWS\\system32\\UbinstGMT.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}\InprocServer32]
@="C:\\WINDOWS\\system32\\LHPNM12n.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}\InprocServer32]
@="C:\\WINDOWS\\system32\\kirnel32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}\InprocServer32]
@="C:\\WINDOWS\\system32\\rDsmxs.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}\InprocServer32]
@="C:\\WINDOWS\\system32\\mrcndmgr.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}\InprocServer32]
@="C:\\WINDOWS\\system32\\tyddd.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}\InprocServer32]
@="C:\\WINDOWS\\system32\\aurace.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
aqycfilt.dll Fri 4 Nov 2005 18:37:58 ..S.R 234,218 228.73 K
aurace.dll Sat 5 Nov 2005 8:05:24 ..S.R 235,785 230.26 K
azaslg~1.dll Fri 4 Nov 2005 18:40:40 ..S.R 234,218 228.73 K
browseui.dll Sat 3 Sep 2005 10:22:04 A.... 1,019,904 996.00 K
cdfview.dll Sat 3 Sep 2005 10:22:04 A.... 151,040 147.50 K
cdosys.dll Sat 10 Sep 2005 12:23:42 A.... 2,067,968 1.97 M
cwedui.dll Mon 31 Oct 2005 17:30:40 ..S.R 233,794 228.31 K
danim.dll Sat 3 Sep 2005 10:22:04 A.... 1,053,696 1.00 M
dxtrans.dll Sat 3 Sep 2005 10:22:04 A.... 205,312 200.50 K
enl0l1~1.dll Fri 4 Nov 2005 11:56:02 ..S.R 234,218 228.73 K
extmgr.dll Sat 3 Sep 2005 10:22:04 ..... 55,808 54.50 K
fp0m03~1.dll Thu 3 Nov 2005 20:57:50 ..S.R 234,218 228.73 K
fp4o03~1.dll Sat 5 Nov 2005 9:00:02 ..S.R 235,785 230.26 K
gpjql3~1.dll Fri 4 Nov 2005 15:07:52 ..S.R 235,731 230.20 K
hr6o05~1.dll Fri 4 Nov 2005 18:46:04 ..S.R 234,218 228.73 K
ib50_32.dll Wed 2 Nov 2005 17:32:26 ..S.R 234,218 228.73 K
iepeers.dll Sat 3 Sep 2005 10:22:04 A.... 251,392 245.50 K
inseng.dll Sat 3 Sep 2005 10:22:04 A.... 96,256 94.00 K
ir4ul5~1.dll Fri 4 Nov 2005 19:29:44 ..S.R 236,163 230.63 K
islzma.dll Fri 21 Oct 2005 15:50:14 A.... 102,912 100.50 K
jxdw400.dll Tue 1 Nov 2005 16:34:42 ..S.R 233,794 228.31 K
k4nole~1.dll Fri 4 Nov 2005 18:19:56 ..S.R 234,218 228.73 K
k808li~1.dll Fri 4 Nov 2005 21:44:16 ..S.R 236,026 230.49 K
kirnel32.dll Fri 4 Nov 2005 18:41:04 ..S.R 234,218 228.73 K
ktlql7~1.dll Fri 4 Nov 2005 19:29:50 ..S.R 235,472 229.95 K
lhpnm12n.dll Fri 4 Nov 2005 21:44:16 ..S.R 234,218 228.73 K
linkinfo.dll Thu 1 Sep 2005 12:11:54 A.... 19,968 19.50 K
lrdxf12n.dll Fri 4 Nov 2005 22:23:48 ..S.R 234,218 228.73 K
ltl027~1.dll Tue 1 Nov 2005 17:09:24 ..S.R 233,794 228.31 K
lv4409~1.dll Fri 4 Nov 2005 16:35:36 ..S.R 234,667 229.16 K
m6lslg~1.dll Fri 4 Nov 2005 18:38:02 ..S.R 234,538 229.04 K
mbsreg~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,112 25.50 K
mbsuse~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,624 26.00 K
mbswin~1.dll Fri 9 Sep 2005 8:23:10 A.... 51,200 50.00 K
mrcndmgr.dll Fri 4 Nov 2005 19:29:44 ..S.R 234,218 228.73 K
mshtml.dll Tue 4 Oct 2005 18:26:00 A.... 3,015,168 2.88 M
mshtmled.dll Sat 3 Sep 2005 10:22:06 A.... 448,512 438.00 K
msrating.dll Sat 3 Sep 2005 10:22:06 A.... 146,432 143.00 K
mstime.dll Sat 3 Sep 2005 10:22:06 A.... 530,432 518.00 K
mv0sl9~1.dll Fri 4 Nov 2005 18:13:56 ..S.R 235,927 230.39 K
n2n6lc~1.dll Thu 3 Nov 2005 17:55:32 ..S.R 236,849 231.30 K
netman.dll Tue 23 Aug 2005 4:59:46 A.... 197,632 193.00 K
o6840g~1.dll Fri 4 Nov 2005 22:19:16 ..S.R 234,218 228.73 K
pngfilt.dll Sat 3 Sep 2005 10:22:06 A.... 39,424 38.50 K
quartz.dll Tue 30 Aug 2005 14:43:42 A.... 1,287,680 1.23 M
rbap350.dll Fri 9 Sep 2005 8:23:10 A.... 60,416 59.00 K
rbrege~1.dll Fri 9 Sep 2005 8:23:10 A.... 73,216 71.50 K
rbsele~1.dll Fri 9 Sep 2005 8:23:10 A.... 27,648 27.00 K
rbspri~1.dll Fri 9 Sep 2005 8:23:10 A.... 56,832 55.50 K
rdsmxs.dll Fri 4 Nov 2005 18:51:22 ..S.R 234,218 228.73 K
shdocvw.dll Sat 3 Sep 2005 10:22:06 A.... 1,483,776 1.41 M
shell32.dll Fri 23 Sep 2005 13:35:30 A.... 8,450,560 8.06 M
shlwapi.dll Sat 3 Sep 2005 10:22:06 A.... 473,600 462.50 K
sirenacm.dll Thu 13 Oct 2005 10:41:06 A.... 118,784 116.00 K
tyddd.dll Fri 4 Nov 2005 22:19:36 ..S.R 234,218 228.73 K
ubinst~1.dll Thu 3 Nov 2005 15:54:30 ..S.R 236,849 231.30 K
umpnpmgr.dll Tue 23 Aug 2005 14:05:42 A.... 123,392 120.50 K
urlmon.dll Sat 3 Sep 2005 10:22:06 A.... 608,768 594.50 K
wininet.dll Sat 3 Sep 2005 10:22:06 A.... 658,432 643.00 K
winsrv.dll Thu 1 Sep 2005 12:11:54 A.... 291,840 285.00 K
wrlogo~1.dll Mon 24 Oct 2005 12:19:50 A.... 492,544 481.00 K
wrlzma.dll Mon 24 Oct 2005 12:19:46 A.... 17,920 17.50 K

62 items found: 62 files (28 H/S), 0 directories.
Total of file sizes: 30,305,426 bytes 28.90 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
atmtdd~1.tmp Sun 23 Oct 2005 18:15:08 A.... 0 0.00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 0 bytes 0.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 741B-A95D

Directory of C:\WINDOWS\System32

05/11/2005 09:00 AM 235,785 fp4o03h3e.dll
05/11/2005 08:05 AM 235,785 aurace.dll
04/11/2005 10:23 PM 234,218 Lrdxf12n.dll
04/11/2005 10:19 PM 234,218 tyddd.dll
04/11/2005 10:19 PM 234,218 o6840glqe6qe0.dll
04/11/2005 09:44 PM 234,218 LHPNM12n.dll
04/11/2005 09:44 PM 236,026 k808lidu1808.dll
04/11/2005 07:29 PM 235,472 ktlql7351.dll
04/11/2005 07:29 PM 234,218 mrcndmgr.dll
04/11/2005 07:29 PM 236,163 ir4ul5h91.dll
04/11/2005 06:51 PM 234,218 rDsmxs.dll
04/11/2005 06:46 PM 234,218 hr6o05j3e.dll
04/11/2005 06:41 PM 234,218 kirnel32.dll
04/11/2005 06:40 PM 234,218 azaslg3716.dll
04/11/2005 06:38 PM 234,538 m6lslg3716.dll
04/11/2005 06:37 PM 234,218 aqycfilt.dll
04/11/2005 06:19 PM 234,218 k4nole531h.dll
04/11/2005 06:13 PM 235,927 mv0sl9d71.dll
04/11/2005 04:35 PM 234,667 lv4409hqe.dll
04/11/2005 03:07 PM 235,731 gpjql3151.dll
04/11/2005 11:56 AM 234,218 enl0l13m1.dll
03/11/2005 09:50 PM 3,766 KGyGaAvL.sys
03/11/2005 08:57 PM 234,218 fp0m03d1e.dll
03/11/2005 08:53 PM 56 EC756A2DDD.sys
03/11/2005 05:55 PM 236,849 n2n6lc5s1f.dll
03/11/2005 03:54 PM 236,849 UbinstGMT.dll
02/11/2005 05:32 PM 234,218 ib50_32.dll
01/11/2005 05:09 PM 233,794 ltl0273mg.dll
01/11/2005 04:34 PM 233,794 jxdw400.dll
31/10/2005 11:30 PM <DIR> dllcache
31/10/2005 05:30 PM 233,794 cwedui.dll
29/12/2004 09:50 PM <DIR> Microsoft
30 File(s) 6,578,048 bytes
2 Dir(s) 48,017,768,448 bytes free

[Armodeluxe]

Spysweeper found too many infections, but the main one, look2me is still there..I wonder if it's a brand new variant even Spysweeper isn't getting yet..

Let's give it one more try and if no success, we'll revert to manual removal..so please update Spysweeper and make one more scan..

When done, post a new Option1 log, Spysweeper log, and a new HijackThis log..

From the moment you get the new Option1 log and the HijackThis log, DO NOT REBOOT UNTIL FURTHER ISTRUCTIONS

[redghia]

I should have been more careful when running spysweeper as i am running Encrypted magic folders which hides files from windows, Guess what spysweeper deletes ...................All files which are hidden from the Windows OS


Lost a whole heap of pictures and about 1 gig of old accounting info - At least i have backups of the accounting stuff

[redghia]

Logfile of HijackThis v1.99.1
Scan saved at 12:42:08 PM, on 6/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\PROGRA~1\TWEAKM~1\TMTray.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Documents and Settings\Ashley\My Documents\Programs\Spyware Programs\HijackThis.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [TweakMASTER] "C:\PROGRA~1\TWEAKM~1\TMTray.exe"
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MSN Messenger.lnk = C:\Program Files\MSN Messenger\msnmsgr.exe
O4 - Startup: SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13....es/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.co...clean_micro.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124188782390
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zon...ot.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O18 - Protocol: bw+0 - {BBD517CC-DE59-4465-A135-694E1859EF1D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: default - C:\WINDOWS\system32\mfrle32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Edited by redghia, 05 November 2005 - 08:11 PM.

[redghia]

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\default]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mfrle32.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{9D40D638-613B-D136-DA60-19F06B3193A4}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device"
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device ContextMenuHandler"
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}"="Siemens SX1 PropertySheetHandler"
"{48F45200-91E6-11CE-8A4F-0080C81A28D4}"="TMD Shell Extension"
"{771A9DA0-731A-11CE-993C-00AA004ADB6C}"="VBPropSheet"
"{08625A55-6B3A-4109-88D8-56E8E333BB5E}"=""
"{E1322F09-02B6-4E72-B5CC-6B795E758A7B}"=""
"{FFF53BEF-BDA8-4AE2-8132-1ED35E97AD8C}"=""
"{52873B9C-4FB9-4D86-9A8F-80B81F2BB70D}"=""
"{5C9B06B7-04C7-4023-A090-A8008C37FABF}"=""
"{DAF11285-46F9-45A4-8383-F7A1EBE87E8F}"=""
"{A0BBE383-78E3-4C73-8128-1180B21D6A01}"=""
"{4683E64C-B125-495F-86F4-BFB5247CEDB8}"=""
"{E2CFB238-033C-429C-AEA0-4BFA6AF41BC9}"=""
"{EAA67C8D-5396-4ED9-9070-F1E9C30EB045}"=""
"{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension"
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{338A5538-4F3F-4DFE-8A14-E18D6E2EE8F1}"=""
"{5F98A4B6-CD25-42E8-81F2-2D6F392D1A84}"=""
"{ECDB9291-581E-441F-BBFB-A5DD3E73A550}"=""
"{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}"=""
"{F7F4E57E-2EBA-4123-903B-F1B85C40F791}"=""
"{E47953F8-125D-44A3-B6AF-B9C476F91E80}"=""
"{CD8D6C15-0BB8-4BDD-BA31-D79166660EEE}"=""
"{D3E9B3D1-22C7-4218-BA26-C0870B87441E}"=""
"{C25B7CF2-04EB-4FEF-BDD1-E937FC107EA2}"=""
"{8DF69A41-8595-4603-9687-17878366E970}"=""
"{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}"=""
"{90297BEE-CA79-485B-A504-50437C73BC1C}"=""
"{AADB38B6-0FCF-4658-B241-0768463432A2}"=""
"{CE85D680-9227-4EC0-9011-CF8F65BF9C69}"=""
"{40A0BE73-1DA1-47A9-964D-69207A2B5055}"=""
"{FAB9D278-019D-4BD0-AB48-B5DA18735547}"=""
"{2FF0E91F-F374-4285-8950-192EDE10110F}"=""
"{EEA42CC7-3814-4724-B055-1FD9177C68E5}"=""
"{031E5D37-227D-49F3-9FE0-20891140911F}"=""
"{22A4C29F-5E0D-472B-9A39-E558935E4219}"=""
"{77664C73-DC80-4D79-8150-062055E5FC8E}"=""
"{4CB8FBB3-1B8B-4532-BCBE-978745D1C8AD}"=""
"{5F0EF905-E697-4C41-8A46-2F52DE1707C3}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}\InprocServer32]
@="C:\\WINDOWS\\system32\\jxdw400.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}\InprocServer32]
@="C:\\WINDOWS\\system32\\aqycfilt.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}\InprocServer32]
@="C:\\WINDOWS\\system32\\UbinstGMT.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}\InprocServer32]
@="C:\\WINDOWS\\system32\\kirnel32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}\InprocServer32]
@="C:\\WINDOWS\\system32\\rDsmxs.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}\InprocServer32]
@="C:\\WINDOWS\\system32\\mrcndmgr.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}\InprocServer32]
@="C:\\WINDOWS\\system32\\tyddd.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}\InprocServer32]
@="C:\\WINDOWS\\system32\\aurace.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5F0EF905-E697-4C41-8A46-2F52DE1707C3}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5F0EF905-E697-4C41-8A46-2F52DE1707C3}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5F0EF905-E697-4C41-8A46-2F52DE1707C3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5F0EF905-E697-4C41-8A46-2F52DE1707C3}\InprocServer32]
@="C:\\WINDOWS\\system32\\rvhx32.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
aqycfilt.dll Fri 4 Nov 2005 18:37:58 ..S.R 234,218 228.73 K
atl71.dll Mon 10 Oct 2005 2:46:00 A.... 89,088 87.00 K
aurace.dll Sat 5 Nov 2005 8:05:24 ..S.R 235,785 230.26 K
azaslg~1.dll Fri 4 Nov 2005 18:40:40 ..S.R 234,218 228.73 K
browseui.dll Sat 3 Sep 2005 10:22:04 A.... 1,019,904 996.00 K
cdfview.dll Sat 3 Sep 2005 10:22:04 A.... 151,040 147.50 K
cdosys.dll Sat 10 Sep 2005 12:23:42 A.... 2,067,968 1.97 M
cwedui.dll Mon 31 Oct 2005 17:30:40 ..S.R 233,794 228.31 K
danim.dll Sat 3 Sep 2005 10:22:04 A.... 1,053,696 1.00 M
dxtrans.dll Sat 3 Sep 2005 10:22:04 A.... 205,312 200.50 K
enl0l1~1.dll Fri 4 Nov 2005 11:56:02 ..S.R 234,218 228.73 K
extmgr.dll Sat 3 Sep 2005 10:22:04 ..... 55,808 54.50 K
fp0m03~1.dll Thu 3 Nov 2005 20:57:50 ..S.R 234,218 228.73 K
fp4o03~1.dll Sat 5 Nov 2005 9:00:02 ..S.R 235,785 230.26 K
gpjql3~1.dll Fri 4 Nov 2005 15:07:52 ..S.R 235,731 230.20 K
hr2u05~1.dll Sat 5 Nov 2005 20:06:38 ..S.R 234,218 228.73 K
hr6o05~1.dll Fri 4 Nov 2005 18:46:04 ..S.R 234,218 228.73 K
ib50_32.dll Wed 2 Nov 2005 17:32:26 ..S.R 234,218 228.73 K
iepeers.dll Sat 3 Sep 2005 10:22:04 A.... 251,392 245.50 K
inseng.dll Sat 3 Sep 2005 10:22:04 A.... 96,256 94.00 K
ir4ul5~1.dll Fri 4 Nov 2005 19:29:44 ..S.R 236,163 230.63 K
islzma.dll Fri 21 Oct 2005 15:50:14 A.... 102,912 100.50 K
jxdw400.dll Tue 1 Nov 2005 16:34:42 ..S.R 233,794 228.31 K
k4nole~1.dll Fri 4 Nov 2005 18:19:56 ..S.R 234,218 228.73 K
k808li~1.dll Fri 4 Nov 2005 21:44:16 ..S.R 236,026 230.49 K
kemutb.dll Mon 10 Oct 2005 2:46:00 A.... 143,360 140.00 K
kemutil.dll Mon 10 Oct 2005 2:46:00 A.... 94,208 92.00 K
kemwnd.dll Mon 10 Oct 2005 2:46:00 A.... 86,016 84.00 K
kemxml.dll Mon 10 Oct 2005 2:46:00 A.... 65,536 64.00 K
kirnel32.dll Fri 4 Nov 2005 18:41:04 ..S.R 234,218 228.73 K
ktlql7~1.dll Fri 4 Nov 2005 19:29:50 ..S.R 235,472 229.95 K
lhpnm12n.dll Fri 4 Nov 2005 21:44:16 ..S.R 234,218 228.73 K
linkinfo.dll Thu 1 Sep 2005 12:11:54 A.... 19,968 19.50 K
lrdxf12n.dll Fri 4 Nov 2005 22:23:48 ..S.R 234,218 228.73 K
ltl027~1.dll Tue 1 Nov 2005 17:09:24 ..S.R 233,794 228.31 K
lv4409~1.dll Fri 4 Nov 2005 16:35:36 ..S.R 234,667 229.16 K
m6lslg~1.dll Fri 4 Nov 2005 18:38:02 ..S.R 234,538 229.04 K
mbsreg~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,112 25.50 K
mbsuse~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,624 26.00 K
mbswin~1.dll Fri 9 Sep 2005 8:23:10 A.... 51,200 50.00 K
mfc71.dll Mon 10 Oct 2005 2:46:00 A.... 1,060,864 1.01 M
mfc71u.dll Mon 10 Oct 2005 2:46:00 A.... 1,047,552 1023.00 K
mrcndmgr.dll Fri 4 Nov 2005 19:29:44 ..S.R 234,218 228.73 K
mshtml.dll Tue 4 Oct 2005 18:26:00 A.... 3,015,168 2.88 M
mshtmled.dll Sat 3 Sep 2005 10:22:06 A.... 448,512 438.00 K
msrating.dll Sat 3 Sep 2005 10:22:06 A.... 146,432 143.00 K
mstime.dll Sat 3 Sep 2005 10:22:06 A.... 530,432 518.00 K
msvcp71.dll Mon 10 Oct 2005 2:46:00 A.... 499,712 488.00 K
msvcr71.dll Mon 10 Oct 2005 2:46:00 A.... 348,160 340.00 K
mv0sl9~1.dll Fri 4 Nov 2005 18:13:56 ..S.R 235,927 230.39 K
n2n6lc~1.dll Thu 3 Nov 2005 17:55:32 ..S.R 236,849 231.30 K
netman.dll Tue 23 Aug 2005 4:59:46 A.... 197,632 193.00 K
o6840g~1.dll Fri 4 Nov 2005 22:19:16 ..S.R 234,218 228.73 K
pngfilt.dll Sat 3 Sep 2005 10:22:06 A.... 39,424 38.50 K
quartz.dll Tue 30 Aug 2005 14:43:42 A.... 1,287,680 1.23 M
rbap350.dll Fri 9 Sep 2005 8:23:10 A.... 60,416 59.00 K
rbrege~1.dll Fri 9 Sep 2005 8:23:10 A.... 73,216 71.50 K
rbsele~1.dll Fri 9 Sep 2005 8:23:10 A.... 27,648 27.00 K
rbspri~1.dll Fri 9 Sep 2005 8:23:10 A.... 56,832 55.50 K
rdsmxs.dll Fri 4 Nov 2005 18:51:22 ..S.R 234,218 228.73 K
rvhx32.dll Sun 6 Nov 2005 8:23:48 ..S.R 235,024 229.52 K
shdocvw.dll Sat 3 Sep 2005 10:22:06 A.... 1,483,776 1.41 M
shell32.dll Fri 23 Sep 2005 13:35:30 A.... 8,450,560 8.06 M
shlwapi.dll Sat 3 Sep 2005 10:22:06 A.... 473,600 462.50 K
sirenacm.dll Thu 13 Oct 2005 10:41:06 A.... 118,784 116.00 K
ubinst~1.dll Thu 3 Nov 2005 15:54:30 ..S.R 236,849 231.30 K
umpnpmgr.dll Tue 23 Aug 2005 14:05:42 A.... 123,392 120.50 K
unicows.dll Mon 10 Oct 2005 2:46:00 A.... 258,352 252.30 K
urlmon.dll Sat 3 Sep 2005 10:22:06 A.... 608,768 594.50 K
wininet.dll Sat 3 Sep 2005 10:22:06 A.... 658,432 643.00 K
winsrv.dll Thu 1 Sep 2005 12:11:54 A.... 291,840 285.00 K
wrlogo~1.dll Mon 24 Oct 2005 12:19:50 A.... 492,544 481.00 K
wrlzma.dll Mon 24 Oct 2005 12:19:46 A.... 17,920 17.50 K

73 items found: 73 files (29 H/S), 0 directories.
Total of file sizes: 34,233,298 bytes 32.64 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
atmtdd~1.tmp Sun 23 Oct 2005 18:15:08 A.... 0 0.00 K
guard.tmp Sun 6 Nov 2005 9:08:26 ..S.R 235,024 229.52 K

2 items found: 2 files (1 H/S), 0 directories.
Total of file sizes: 235,024 bytes 229.52 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 741B-A95D

Directory of C:\WINDOWS\System32

06/11/2005 09:08 AM 235,024 guard.tmp
06/11/2005 08:23 AM 235,024 rvhx32.dll
05/11/2005 08:06 PM 234,218 hr2u05f9e.dll
05/11/2005 07:48 PM <DIR> dllcache
05/11/2005 09:00 AM 235,785 fp4o03h3e.dll
05/11/2005 08:05 AM 235,785 aurace.dll
04/11/2005 10:23 PM 234,218 Lrdxf12n.dll
04/11/2005 10:19 PM 234,218 o6840glqe6qe0.dll
04/11/2005 09:44 PM 234,218 LHPNM12n.dll
04/11/2005 09:44 PM 236,026 k808lidu1808.dll
04/11/2005 07:29 PM 235,472 ktlql7351.dll
04/11/2005 07:29 PM 234,218 mrcndmgr.dll
04/11/2005 07:29 PM 236,163 ir4ul5h91.dll
04/11/2005 06:51 PM 234,218 rDsmxs.dll
04/11/2005 06:46 PM 234,218 hr6o05j3e.dll
04/11/2005 06:41 PM 234,218 kirnel32.dll
04/11/2005 06:40 PM 234,218 azaslg3716.dll
04/11/2005 06:38 PM 234,538 m6lslg3716.dll
04/11/2005 06:37 PM 234,218 aqycfilt.dll
04/11/2005 06:19 PM 234,218 k4nole531h.dll
04/11/2005 06:13 PM 235,927 mv0sl9d71.dll
04/11/2005 04:35 PM 234,667 lv4409hqe.dll
04/11/2005 03:07 PM 235,731 gpjql3151.dll
04/11/2005 11:56 AM 234,218 enl0l13m1.dll
03/11/2005 09:50 PM 3,766 KGyGaAvL.sys
03/11/2005 08:57 PM 234,218 fp0m03d1e.dll
03/11/2005 08:53 PM 56 EC756A2DDD.sys
03/11/2005 05:55 PM 236,849 n2n6lc5s1f.dll
03/11/2005 03:54 PM 236,849 UbinstGMT.dll
02/11/2005 05:32 PM 234,218 ib50_32.dll
01/11/2005 05:09 PM 233,794 ltl0273mg.dll
01/11/2005 04:34 PM 233,794 jxdw400.dll
31/10/2005 05:30 PM 233,794 cwedui.dll
29/12/2004 09:50 PM <DIR> Microsoft
32 File(s) 7,048,096 bytes
2 Dir(s) 49,006,047,232 bytes free

[redghia]

Spy sweeper log


********


10:32 AM: | Start of Session, Sunday, 6 November 2005 |
10:32 AM: Spy Sweeper started
10:32 AM: Sweep initiated using definitions version 567
10:32 AM: Starting Memory Sweep
10:33 AM: Found Adware: icannnews
10:33 AM: Detected running threat: C:\WINDOWS\system32\k6080gdue6080.dll (ID = 83)
10:33 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:33 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:33 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:33 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:36 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:36 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:36 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:36 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:38 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:38 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:38 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:38 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:38 AM: Detected running threat: C:\WINDOWS\system32\uplmon.dll (ID = 83)
10:39 AM: Memory Sweep Complete, Elapsed Time: 00:06:16
10:39 AM: Starting Registry Sweep
10:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:39 AM: Registry Sweep Complete, Elapsed Time:00:00:48
10:39 AM: Starting Cookie Sweep
10:39 AM: Found Spy Cookie: yieldmanager cookie
10:39 AM: [email protected][1].txt (ID = 3751)
10:39 AM: Found Spy Cookie: 2o7.net cookie
10:39 AM: [email protected][1].txt (ID = 1958)
10:40 AM: [email protected][2].txt (ID = 3751)
10:40 AM: Found Spy Cookie: azjmp cookie
10:40 AM: evan@azjmp[2].txt (ID = 2270)
10:40 AM: Found Spy Cookie: starware.com cookie
10:40 AM: [email protected][1].txt (ID = 3442)
10:40 AM: Found Spy Cookie: rn11 cookie
10:40 AM: evan@rn11[2].txt (ID = 3261)
10:40 AM: [email protected][1].txt (ID = 3442)
10:40 AM: Found Spy Cookie: abcsearch cookie
10:40 AM: cornelius@abcsearch[1].txt (ID = 2033)
10:40 AM: [email protected][1].txt (ID = 3751)
10:40 AM: Found Spy Cookie: apmebf cookie
10:40 AM: cornelius@apmebf[2].txt (ID = 2229)
10:40 AM: Found Spy Cookie: atlas dmt cookie
10:40 AM: cornelius@atdmt[1].txt (ID = 2253)
10:40 AM: Found Spy Cookie: belnk cookie
10:40 AM: cornelius@belnk[1].txt (ID = 2292)
10:40 AM: Found Spy Cookie: casalemedia cookie
10:40 AM: cornelius@casalemedia[2].txt (ID = 2354)
10:40 AM: [email protected][2].txt (ID = 2293)
10:40 AM: Found Spy Cookie: qksrv cookie
10:40 AM: cornelius@qksrv[2].txt (ID = 3213)
10:40 AM: ashley@atdmt[1].txt (ID = 2253)
10:40 AM: Found Spy Cookie: statcounter cookie
10:40 AM: ashley@statcounter[1].txt (ID = 3447)
10:40 AM: Found Spy Cookie: webtrendslive cookie
10:40 AM: [email protected][1].txt (ID = 3667)
10:40 AM: Cookie Sweep Complete, Elapsed Time: 00:00:11
10:40 AM: Starting File Sweep
10:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:44 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:44 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:44 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:44 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:46 AM: Found Adware: isearch toolbar
10:46 AM: a0064371.ini (ID = 64354)
10:46 AM: Found Adware: screensavers
10:46 AM: a0064372.exe (ID = 74759)
10:46 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:46 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:46 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:46 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:48 AM: Found Adware: webrebates
10:48 AM: a0064374.dll (ID = 83909)
10:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:50 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:50 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:50 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:50 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:52 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:52 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:52 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:52 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:53 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:53 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:53 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:53 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:54 AM: Found Adware: hotbar
10:54 AM: a0064368.exe (ID = 121818)
10:54 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:54 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:54 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:54 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:54 AM: a0064367.exe (ID = 121818)
10:55 AM: a0064366.exe (ID = 62332)
10:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
10:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
10:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:00 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:00 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:04 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:04 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:05 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:05 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:05 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:05 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:06 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:06 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:06 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:06 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:08 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:08 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:09 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:09 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:09 AM: Found Adware: targetsaver
11:09 AM: a0064373.exe (ID = 166444)
11:10 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:10 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:10 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:10 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:12 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:12 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:13 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:13 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:13 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:13 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:14 AM: Warning: Unhandled Archive Type
11:14 AM: Warning: Unhandled Archive Type
11:14 AM: Warning: Unhandled Archive Type
11:15 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:15 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:15 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:15 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:16 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:16 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:16 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:16 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:17 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:17 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:17 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:17 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:18 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:18 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:18 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:18 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:19 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:19 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:19 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:19 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:21 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:21 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:21 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:21 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:22 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:22 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:22 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:22 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:23 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:23 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:23 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:23 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:24 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:24 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:24 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:24 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:26 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:26 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:26 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:26 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:27 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:27 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:27 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:27 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:28 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:28 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:28 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:28 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:29 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:29 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:29 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:29 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:31 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:31 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:31 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:31 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:32 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:32 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:32 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:32 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:33 AM: Warning: Unhandled Archive Type
11:33 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:33 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:33 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:33 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:34 AM: Warning: Invalid Stream
11:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:34 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:34 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:35 AM: File Sweep Complete, Elapsed Time: 00:55:00
11:35 AM: Full Sweep has completed. Elapsed time 01:02:29
11:35 AM: Traces Found: 27
11:36 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:36 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:36 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:36 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:37 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:37 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:38 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:38 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:38 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:38 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:39 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:39 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:40 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:40 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:42 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:42 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:43 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:43 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:44 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:44 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:44 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:44 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:45 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:45 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:46 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:46 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:46 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:46 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:48 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:48 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:49 AM: Removal process initiated
11:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
11:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
11:49 AM: Quarantining All Traces: icannnews
11:49 AM: icannnews is in use. It will be removed on reboot.
11:49 AM: C:\WINDOWS\system32\k6080gdue6080.dll is in use. It will be removed on reboot.
11:49 AM: C:\WINDOWS\system32\uplmon.dll is in use. It will be removed on reboot.
11:49 AM: Quarantining All Traces: hotbar
11:50 AM: Quarantining All Traces: isearch toolbar
11:50 AM: Quarantining All Traces: screensavers
11:50 AM: Quarantining All Traces: targetsaver
12:31 PM: Quarantining All Traces: webrebates
12:31 PM: Quarantining All Traces: 2o7.net cookie
12:31 PM: Quarantining All Traces: abcsearch cookie
12:31 PM: Quarantining All Traces: apmebf cookie
12:31 PM: Quarantining All Traces: atlas dmt cookie
12:31 PM: Quarantining All Traces: azjmp cookie
12:31 PM: Quarantining All Traces: belnk cookie
12:31 PM: Quarantining All Traces: casalemedia cookie
12:31 PM: Quarantining All Traces: qksrv cookie
12:31 PM: Quarantining All Traces: rn11 cookie
12:31 PM: Quarantining All Traces: starware.com cookie
12:31 PM: Quarantining All Traces: statcounter cookie
12:31 PM: Quarantining All Traces: webtrendslive cookie
12:31 PM: Quarantining All Traces: yieldmanager cookie
12:31 PM: Preparing to restart your computer. Please wait...
12:31 PM: Removal process completed. Elapsed time 00:42:45
12:35 PM: Processing Startup Alerts
12:35 PM: Removed Startup entry: PopularScreensaversWallpaper
********
10:30 AM: | Start of Session, Sunday, 6 November 2005 |
10:30 AM: Spy Sweeper started
10:31 AM: Your spyware definitions have been updated.
10:32 AM: | End of Session, Sunday, 6 November 2005 |

Edited by redghia, 05 November 2005 - 08:13 PM.

[Armodeluxe]

It looks crippled, but I'm not sure if l2mfix will get everything remaining or we have to revert to manual. First let's try to cripple it more at least, even if it won't get all..

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix.