View Full Version : Smitfraud-C.CoreService, zenosearch
Spybot removes them, but they keep returning.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:09:18 PM, on 8/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\devldr32.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\system32\dwwnw64r.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Stan\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ptdprolog.net/
O2 - BHO: radbanner browser enhancer - {037e789c-0de9-a59b-71ce-930130231543} - C:\WINDOWS\system32\oaqloxwgsmhjvvur.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: agadoo browser optimizer - {5307b893-a881-be69-76db-1f8332adc1ce} - C:\WINDOWS\system32\mnmxatfkkgmduvll.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {E3AB1349-922F-4CD9-B6F2-B189D9B6BB98} - C:\WINDOWS\system32\iifcaxuu.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Deewoo.lnk.disabled
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\dwwnw64r.exe
O4 - Startup: Toolbar.lnk.disabled
O4 - Global Startup: Service Manager.lnk.disabled
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://remote.superiorink.com/dana-cached/setup/NeoterisSetup.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135197102328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
O16 - DPF: {E1AD733A-8259-49EF-980F-C5AB69F12D06} (RunKuma Control) - http://www.kumagames.com/runkuma.cab
O20 - Winlogon Notify: iifcaxuu - C:\WINDOWS\SYSTEM32\iifcaxuu.dll
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 7266 bytes
Hi StanMi
We will begin with ComboFix. Please visit this webpage for download links, and instructions for running the tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New HijackThis log.
A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
I tried to install the recovery console but recieved a warning that the version of XP installed was newer than the version on the original CD.
ComboFix 08-08-30.03 - Stan 2008-09-01 8:19:03.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.452 [GMT -4:00]
Running from: C:\Documents and Settings\Stan\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\csrss.exe
C:\Documents and Settings\Stan\Application Data\macromedia\Flash Player\#SharedObjects\FLLQMXY8\bin.clearspring.com
C:\Documents and Settings\Stan\Application Data\macromedia\Flash Player\#SharedObjects\FLLQMXY8\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Stan\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Stan\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Stan\Cookies\stan@2o7[2].txt
C:\Documents and Settings\Stan\Cookies\stan@imiclk[2].txt
C:\Documents and Settings\Stan\Cookies\stan@insightexpressai[2].txt
C:\Documents and Settings\Stan\Cookies\stan@metrics.adobe[1].txt
C:\Documents and Settings\Stan\Cookies\stan@my.clearchannelradio[1].txt
C:\Documents and Settings\Stan\Cookies\stan@www3.sears[2].txt
C:\Documents and Settings\Stan\Cookies\stan@www35.vzw[2].txt
C:\services.exe
C:\smss.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\faceback.exe
C:\WINDOWS\system32\awtustqQ.dll
C:\WINDOWS\system32\iifcaxuu.dll
C:\WINDOWS\system32\lphc39oj0e91v.exe
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\winpfz33.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR
((((((((((((((((((((((((( Files Created from 2008-08-01 to 2008-09-01 )))))))))))))))))))))))))))))))
.
2008-08-30 16:49 . 2008-08-31 01:36 1,476 --a------ C:\WINDOWS\wininit.ini
2008-08-30 12:13 . 2008-08-30 12:13 <DIR> d-------- C:\WINDOWS\system32\wTR02
2008-08-30 12:13 . 2008-08-30 12:13 <DIR> d-------- C:\WINDOWS\system32\towl
2008-08-30 12:13 . 2008-08-30 12:13 <DIR> d-------- C:\WINDOWS\system32\tec
2008-08-30 12:13 . 2008-08-30 12:13 <DIR> d-------- C:\WINDOWS\system32\mpull
2008-08-30 12:13 . 2008-08-30 12:13 <DIR> d-------- C:\WINDOWS\system32\dbl
2008-08-30 12:13 . 2008-08-30 12:13 <DIR> d-------- C:\WINDOWS\system32\bdir
2008-08-30 12:13 . 2008-08-30 12:13 <DIR> d-------- C:\temp\dax41
2008-08-30 12:13 . 2008-08-30 12:13 108,544 --a------ C:\ctfmon.exe
2008-08-30 12:13 . 2008-08-30 12:13 23,610 --a------ C:\Documents and Settings\Stan\Party_Pics.zip
2008-08-30 12:13 . 2008-08-30 12:13 354 --a------ C:\50.bat
2008-08-30 11:59 . 2008-08-30 11:59 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-08-30 11:14 . 2008-08-30 11:24 134,358,357 --a------ C:\PC-GAMES - Risk 2 (Tested).zip
2008-08-30 11:02 . 2008-08-30 11:02 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2008-08-30 10:50 . 2008-08-30 23:28 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\WINDOWS\Sun
2008-08-30 10:42 . 2008-08-30 12:13 <DIR> d-------- C:\Documents and Settings\Stan\Application Data\LimeWire
2008-08-30 10:41 . 2008-08-30 10:41 <DIR> d-------- C:\Program Files\Java
2008-08-30 10:41 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-30 10:40 . 2008-08-30 10:40 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-21 20:06 . 2008-08-21 20:35 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-17 18:44 . 2008-08-17 18:44 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-08-13 22:08 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-08 18:51 . 1999-04-23 22:22 528,384 --a------ C:\WINDOWS\KODAKIMG.EXE
2008-08-08 18:51 . 1999-04-23 22:22 114,688 --a------ C:\WINDOWS\KODAKPRV.EXE
2008-08-08 16:49 . 2008-08-08 16:49 <DIR> d-------- C:\Program Files\TWAIN Working Group
2008-08-08 16:49 . 1998-02-06 22:37 299,520 --a------ C:\WINDOWS\uninst.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-30 16:08 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-11 18:26 --------- d-----w C:\Documents and Settings\Stan\Application Data\WeatherBug
2006-03-23 00:31 28,856 ----a-w C:\Documents and Settings\Stan\Application Data\GDIPFONTCACHEV1.DAT
2005-12-30 06:34 2 --shatr C:\WINDOWS\winstart.bat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 18:05 69632]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 13:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
C:\Documents and Settings\Stan\Start Menu\Programs\Startup\
Toolbar.lnk.disabled [2006-01-11 01:11:10 734]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Service Manager.lnk.disabled [2006-01-17 09:04:27 577]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"=
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RegRun WinBait"=C:\WINDOWS\winbait.exe
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"kgsystray"=g:\Program Files\Kuma Games\kgsystray\Kumawar_tray.exe
"KW2SysTray"=G:\Program Files\Kuma Games\KW2SysTray\Kumawar_tray.exe
"pccguide.exe"="E:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"G:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
S1 mtlmnt55;mtlmnt55;C:\WINDOWS\system32\drivers\mtlmnt55.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc8fefc3-fa4a-11dc-a98e-000476cea4ef}]
\Shell\AutoRun\command - L:\LaunchU3.exe
.
- - - - ORPHANS REMOVED - - - -
BHO-{E3AB1349-922F-4CD9-B6F2-B189D9B6BB98} - (no file)
Notify-iifcaxuu - (no file)
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://ptdprolog.net/
O8 -: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 -: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 -: RoboForm Toolbar
O8 -: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {6E5A37BF-FD42-463A-877C-4EB7002E68AE}
O16 -: {E1AD733A-8259-49EF-980F-C5AB69F12D06} - hxxp://www.kumagames.com/runkuma.cab
C:\WINDOWS\Downloaded Program Files\runkuma.inf
C:\WINDOWS\system32\mfc42.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\olepro32.dll
C:\WINDOWS\Downloaded Program Files\runkuma.ocx
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-01 08:24:10
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\snmp.exe
C:\Program Files\Speed Disk\NOPDB.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\WINDOWS\system32\devldr32.exe
.
**************************************************************************
.
Completion time: 2008-09-01 8:27:15 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-01 12:27:12
Pre-Run: 4,163,567,616 bytes free
Post-Run: 4,325,310,464 bytes free
175 --- E O F --- 2008-08-14 21:21:05
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:28:03 AM, on 9/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Stan\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ptdprolog.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Toolbar.lnk.disabled
O4 - Global Startup: Service Manager.lnk.disabled
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://remote.superiorink.com/dana-cached/setup/NeoterisSetup.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135197102328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
O16 - DPF: {E1AD733A-8259-49EF-980F-C5AB69F12D06} (RunKuma Control) - http://www.kumagames.com/runkuma.cab
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 6756 bytes
You can download bootdisks for SP2 from here (http://support.microsoft.com/kb/310994) and follow instructions from "If you use Windows XP and do not have the Windows CD".
After that:
Open notepad and copy/paste the text in the codebox below into it:
File::
C:\ctfmon.exe
C:\Documents and Settings\Stan\Party_Pics.zip
C:\50.bat
Folder::
C:\WINDOWS\system32\wTR02
C:\WINDOWS\system32\towl
C:\WINDOWS\system32\tec
C:\WINDOWS\system32\mpull
C:\WINDOWS\system32\dbl
C:\WINDOWS\system32\bdir
C:\temp
Driver::
mtlmnt55
Save this as "CFScript"
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
ComboFix log to long to post. Here is the first half. Second half and HJT log in next post.
ComboFix 08-08-30.03 - Stan 2008-09-01 9:04:16.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.461 [GMT -4:00]
Running from: C:\Documents and Settings\Stan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Stan\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\50.bat
C:\ctfmon.exe
C:\Documents and Settings\Stan\Party_Pics.zip
C:\temp
C:\temp\dax41\A3G.log
C:\temp\HP_WebRelease\autorun.inf
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof2412.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof2512.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof2612.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof2712.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof4012.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof4112.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof4212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof5512.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof6212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof7212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof7312.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpof7412.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1012.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1112.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1312.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1412.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1412.rgn
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1512.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1512.rgn
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop1612.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2012.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2112.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2312.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2412.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2512.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2612.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop2712.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop4012.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop4112.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop4212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop5512.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop6112.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop6212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop7212.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop7312.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop7412.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpop8312.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpopd912.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpopeb12.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\chs\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\chs\drivers\win9x_me\hpoupdrx.inf
C:\temp\HP_WebRelease\chs\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\chs\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\chs\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\cht\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\cht\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\cht\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\cht\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\cht\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\cht\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\cht\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\cht\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\cht\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\cht\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\common\drivers\com_os\hpoism01.dll
C:\temp\HP_WebRelease\common\drivers\com_os\hpqip09.dll
C:\temp\HP_WebRelease\common\drivers\com_os\hpqish09.dll
C:\temp\HP_WebRelease\common\drivers\com_os\hpzcfg12.ex_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzcon12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzeng12.ex_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzflt12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzimb12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzimc12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzime12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzimp12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzims12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzimv12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzjui12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzpcl12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzpre12.ex_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzres12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzslk12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzstc12.ex_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzstw12.ex_
C:\temp\HP_WebRelease\common\drivers\com_os\hpztbi12.dl_
C:\temp\HP_WebRelease\common\drivers\com_os\hpztbu12.ex_
C:\temp\HP_WebRelease\common\drivers\com_os\hpztbx12.ex_
C:\temp\HP_WebRelease\common\drivers\com_os\hpzvip12.dl_
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj62-74phgftb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj62-74phgftp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj62-74ppptb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj62-74ppptp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj62-74pptb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj62-74pptp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj72-74phgftg.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj72-74ppptg.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpoj72-74pptg.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppc16-23phgftb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppc16-23phgftp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppc16-23ppptb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppc16-23ppptp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppc16-23pptb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppc16-23pptp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27phgftb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27phgftg.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27phgftp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27ppptb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27ppptg.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27ppptp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27pptb.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27pptg.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hppm26-27pptp.icc
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpz2ku12.dl_
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpzcoi12.dl_
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpzlnt12.dl_
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpzpm312.dl_
C:\temp\HP_WebRelease\common\drivers\win2k_xp\hpzsnt12.dl_
C:\temp\HP_WebRelease\common\drivers\win9x_me\HPZ9XD12.dr_
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzfac12.dl_
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzglu12.exe
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzl9x12.dl_
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzpm112.dl_
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzs9x12.dl_
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzscr12.dl_
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzsta9x.ex_
C:\temp\HP_WebRelease\common\drivers\win9x_me\hpzstsin.dl_
C:\temp\HP_WebRelease\common\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\common\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\csy\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\csy\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\csy\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\csy\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\csy\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\csy\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\csy\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\csy\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\csy\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\csy\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\dan\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\dan\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\dan\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\dan\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\dan\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\dan\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\dan\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\dan\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\dan\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\dan\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\deu\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\deu\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\deu\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\deu\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\deu\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\deu\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\deu\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\deu\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\deu\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\deu\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\Drivers\dot4\win2000\Hpzc3212.dll
C:\temp\HP_WebRelease\Drivers\dot4\win2000\HPZid412.sys
C:\temp\HP_WebRelease\Drivers\dot4\win2000\HPZipr12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win2000\HPZisc12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win2000\HPZius12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win2000\HPZs2k12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win98\HphPar98.vxd
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZBRX12.PDR
C:\temp\HP_WebRelease\Drivers\dot4\win98\hpzc3212.dll
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZid412.sys
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZimn12.dll
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZipa12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZipr12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZisc12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZius12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZs9X12.sys
C:\temp\HP_WebRelease\Drivers\dot4\win98\HPZUCI12.DLL
C:\temp\HP_WebRelease\Drivers\dot4\win98\usbmon.dl_
C:\temp\HP_WebRelease\Drivers\dot4\winxp\hppaufd0.sys
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\_inst32i.ex_
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\_ISDel.exe
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\_Setup.dll
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\_sys1.cab
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\_sys1.hdr
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\_user1.cab
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\_user1.hdr
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\DATA.TAG
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\data1.cab
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\data1.hdr
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\lang.dat
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\layout.bin
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\os.dat
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\Setup.exe
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\SETUP.INI
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\setup.ins
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\setup.lid
C:\temp\HP_WebRelease\Drivers\dot4\wrapper\Wrapper.exe
C:\temp\HP_WebRelease\Drivers\Scanner\hpgtpusd.dll
C:\temp\HP_WebRelease\Drivers\Scanner\hpgwiamd.dll
C:\temp\HP_WebRelease\Drivers\Scanner\hpotiop.dll
C:\temp\HP_WebRelease\Drivers\Scanner\hpotscl.dll
C:\temp\HP_WebRelease\Drivers\Scanner\hpovst08.dll
C:\temp\HP_WebRelease\Drivers\Scanner\usbscan.sy_
C:\temp\HP_WebRelease\Drivers\Uninst\enu\hpomdl05.dat
C:\temp\HP_WebRelease\Drivers\Uninst\esn\hpomdl05.dat
C:\temp\HP_WebRelease\Drivers\Uninst\fra\hpomdl05.dat
C:\temp\HP_WebRelease\Drivers\Uninst\ptb\hpomdl05.dat
C:\temp\HP_WebRelease\dxprl.dat
C:\temp\HP_WebRelease\ell\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof2412.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof2512.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof2612.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof2712.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof4012.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof4112.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof4212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof5512.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof6212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof7212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof7312.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpof7412.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1012.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1112.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1312.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1412.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1412.rgn
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1512.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1512.rgn
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop1612.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2012.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2112.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2312.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2412.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2512.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2612.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop2712.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop4012.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop4112.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop4212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop5512.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop6112.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop6212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop7212.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop7312.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop7412.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpop8312.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpopd912.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpopeb12.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\enu\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\enu\drivers\win9x_me\hpoupdrx.inf
C:\temp\HP_WebRelease\enu\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\enu\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\enu\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\esm\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\esm\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\esm\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\esm\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\esm\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\esm\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\esm\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\esm\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\esm\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\esm\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\fin\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\fin\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\fin\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\fin\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\fin\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\fin\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\fin\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\fin\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\fin\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\fin\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\fra\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\fra\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\fra\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\fra\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\fra\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\fra\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\fra\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\fra\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\fra\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\fra\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\grk\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\grk\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\grk\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\grk\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\grk\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\grk\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\grk\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\grk\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\grk\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\grk\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\hpoapd01.dat
C:\temp\HP_WebRelease\hpoglu08.inf
C:\temp\HP_WebRelease\hpohub08.inf
C:\temp\HP_WebRelease\hpomdl05.dat
C:\temp\HP_WebRelease\hpoprl01.dat
C:\temp\HP_WebRelease\hpoprl02.dat
C:\temp\HP_WebRelease\hpoprl03.dat
C:\temp\HP_WebRelease\hpoprl04.dat
C:\temp\HP_WebRelease\hpoprl05.dat
C:\temp\HP_WebRelease\hpoprl07.dat
C:\temp\HP_WebRelease\hpoprl08.dat
C:\temp\HP_WebRelease\hpoprn08.cat
C:\temp\HP_WebRelease\hpoprn08.inf
C:\temp\HP_WebRelease\hposcu08.cat
C:\temp\HP_WebRelease\hposcu08.inf
C:\temp\HP_WebRelease\hpound08.inf
C:\temp\HP_WebRelease\HPOunp08.cat
C:\temp\HP_WebRelease\hpounp08.inf
C:\temp\HP_WebRelease\hpousb08.inf
C:\temp\HP_WebRelease\hpousc08.inf
C:\temp\HP_WebRelease\hpqapd01.dat
C:\temp\HP_WebRelease\hpqhut01.dat
C:\temp\HP_WebRelease\hpqish09.inf
C:\temp\HP_WebRelease\hpqprl01.dat
C:\temp\HP_WebRelease\hpqprl03.dat
C:\temp\HP_WebRelease\Hpzc3212.dll
C:\temp\HP_WebRelease\hpzglu12.exe
C:\temp\HP_WebRelease\HPZid412.cat
C:\temp\HP_WebRelease\hpzid412.inf
C:\temp\HP_WebRelease\hpzid413.cat
C:\temp\HP_WebRelease\hpzid413.inf
C:\temp\HP_WebRelease\HPZipr12.cat
C:\temp\HP_WebRelease\hpzipr12.inf
C:\temp\HP_WebRelease\hpzipr13.cat
C:\temp\HP_WebRelease\hpzipr13.inf
C:\temp\HP_WebRelease\hpzist12.cat
C:\temp\HP_WebRelease\hpzist12.inf
C:\temp\HP_WebRelease\hpzist13.cat
C:\temp\HP_WebRelease\hpzist13.inf
C:\temp\HP_WebRelease\HPZius12.cat
C:\temp\HP_WebRelease\hpzius12.inf
C:\temp\HP_WebRelease\hpzius13.cat
C:\temp\HP_WebRelease\hpzius13.inf
C:\temp\HP_WebRelease\hpzjlog.dll
C:\temp\HP_WebRelease\hpzjpp01.dll
C:\temp\HP_WebRelease\hpzjut01.dll
C:\temp\HP_WebRelease\hpzjvp01.dll
C:\temp\HP_WebRelease\hpzpnp12.dll
C:\temp\HP_WebRelease\HPZprl01.dat
C:\temp\HP_WebRelease\hpzprl02.dat
C:\temp\HP_WebRelease\hpzscr12.dll
C:\temp\HP_WebRelease\HPZUCI12.DLL
C:\temp\HP_WebRelease\hun\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\hun\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\hun\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\hun\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\hun\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\hun\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\hun\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\hun\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\hun\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\hun\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\ita\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\ita\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\ita\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\ita\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\ita\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\ita\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\ita\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\ita\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\ita\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\ita\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof2412.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof2512.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof2612.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof2712.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof4012.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof4112.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof4212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof5512.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof6212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof7212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof7312.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpof7412.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1012.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1112.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1312.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1412.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1412.rgn
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1512.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1512.rgn
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop1612.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2012.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2112.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2312.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2412.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2512.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2612.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop2712.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop4012.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop4112.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop4212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop5512.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop6112.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop6212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop7212.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop7312.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop7412.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpop8312.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpopd912.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpopeb12.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\jpn\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\jpn\drivers\win9x_me\hpoupdrx.inf
C:\temp\HP_WebRelease\jpn\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\jpn\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\jpn\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\kor\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\kor\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\kor\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\kor\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\kor\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\kor\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\kor\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\kor\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\kor\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\kor\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\license.txt
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof2412.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof2512.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof2612.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof2712.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof4012.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof4112.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof4212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof5512.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof6212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof7212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof7312.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpof7412.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1012.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1112.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1312.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1412.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1412.rgn
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1512.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1512.rgn
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop1612.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2012.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2112.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2312.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2412.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2512.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2612.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop2712.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop4012.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop4112.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop4212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop5512.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop6112.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop6212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop7212.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop7312.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop7412.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpop8312.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpopd912.dat
C:\temp\HP_WebRelease\met\drivers\com_lang\hpopeb12.dat
C:\temp\HP_WebRelease\msvcirt.dll
C:\temp\HP_WebRelease\msvcrt.dll
C:\temp\HP_WebRelease\nld\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\nld\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\nld\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\nld\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\nld\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\nld\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\nld\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\nld\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\nld\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\nld\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\nob\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\non\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\non\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\non\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\non\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\non\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\non\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\non\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\non\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\non\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\non\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\plk\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\plk\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\plk\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\plk\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\plk\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\plk\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\plk\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\plk\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\plk\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\plk\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\ptb\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\ptb\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\ptb\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\ptb\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\ptb\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\ptb\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\ptb\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\ptb\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\ptb\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\ptb\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\rus\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\rus\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\rus\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\rus\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\rus\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\rus\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\rus\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\rus\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\rus\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\rus\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\Setup.exe
C:\temp\HP_WebRelease\Setup\1_thank_you.bmp
C:\temp\HP_WebRelease\Setup\10_tour.bmp
C:\temp\HP_WebRelease\Setup\2_better_together.bmp
C:\temp\HP_WebRelease\Setup\3_director.bmp
C:\temp\HP_WebRelease\Setup\4_manage_images.bmp
C:\temp\HP_WebRelease\Setup\5_edit_photos.bmp
C:\temp\HP_WebRelease\Setup\6_share_photos.bmp
C:\temp\HP_WebRelease\Setup\7_supplies.bmp
C:\temp\HP_WebRelease\Setup\8_support.bmp
C:\temp\HP_WebRelease\Setup\9_register.bmp
C:\temp\HP_WebRelease\Setup\AiO_Scan\aio_scan.cab
C:\temp\HP_WebRelease\Setup\AiO_Scan\aio_scan.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1000_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1000_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1000trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1000trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1033.mst
C:\temp\HP_WebRelease\Setup\AiOHelp\1034.mst
C:\temp\HP_WebRelease\Setup\AiOHelp\1036.mst
C:\temp\HP_WebRelease\Setup\AiOHelp\1046.mst
C:\temp\HP_WebRelease\Setup\AiOHelp\1100_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1100_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1100trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1100trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1200_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1200_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1200trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1200trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1300_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1300_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1300trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1300trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1310_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1310_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1310trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1310trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1400_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1400_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1400trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1400trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1500_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1500_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1500trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1500trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1600_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1600_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\1600trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\1600trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\21_22_trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\21_22_trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2100_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2100_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2150_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2150_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2170_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2170_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2200_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2200_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2300_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2300_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2300trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2300trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2350_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2350_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2350trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2350trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2400_2500help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2400_2500help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2400_2500trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2400_2500trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2600_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2600_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\2600trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\2600trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\4100_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\4100_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\4100trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\4100trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\4200_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\4200_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\4200trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\4200trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\5500_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\5500_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\5500trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\5500trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\6100_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\6100_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\6100trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\6100trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\6200_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\6200_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\6200trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\6200trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\7200_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\7200_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\7200trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\7200trb.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\7300_help.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\7300_help.msi
C:\temp\HP_WebRelease\Setup\AiOHelp\7300trb.cab
C:\temp\HP_WebRelease\Setup\AiOHelp\7300trb.msi
C:\temp\HP_WebRelease\Setup\AiOInstallBannerCrop.bmp
C:\temp\HP_WebRelease\Setup\AiOSoftware\aiosoftware.cab
C:\temp\HP_WebRelease\Setup\AiOSoftware\aiosoftware.msi
C:\temp\HP_WebRelease\Setup\BufferChm\BufferChm.cab
C:\temp\HP_WebRelease\Setup\BufferChm\BufferChm.msi
C:\temp\HP_WebRelease\Setup\CCC\AccessDeniedUtility.exe
C:\temp\HP_WebRelease\Setup\CCC\collect.bat
C:\temp\HP_WebRelease\Setup\CCC\FixErr1714.exe
C:\temp\HP_WebRelease\Setup\CCC\hpzlgc01.dat
C:\temp\HP_WebRelease\Setup\CCC\HPZlgc01.exe
C:\temp\HP_WebRelease\Setup\CCC\HPZprs01.exe
C:\temp\HP_WebRelease\Setup\chs\ie6setup.exe
C:\temp\HP_WebRelease\Setup\cht\ie6setup.exe
C:\temp\HP_WebRelease\Setup\copy\Copy.cab
C:\temp\HP_WebRelease\Setup\copy\Copy.msi
C:\temp\HP_WebRelease\Setup\CP_AtenaShokunin1Config\CP_AtenaShokunin1Config.cab
C:\temp\HP_WebRelease\Setup\CP_AtenaShokunin1Config\CP_AtenaShokunin1Config.msi
C:\temp\HP_WebRelease\Setup\cp_dwshrek2albums1\cp_dwshrek2albums1.cab
C:\temp\HP_WebRelease\Setup\cp_dwshrek2albums1\cp_dwshrek2albums1.msi
C:\temp\HP_WebRelease\Setup\cp_dwshrek2cards1\cp_dwshrek2cards1.cab
C:\temp\HP_WebRelease\Setup\cp_dwshrek2cards1\cp_dwshrek2cards1.msi
C:\temp\HP_WebRelease\Setup\creativeprojects\CreativeProjects.cab
C:\temp\HP_WebRelease\Setup\creativeprojects\CreativeProjects.msi
C:\temp\HP_WebRelease\Setup\CreativeProjectsTemplates\CreativeProjectsTemplates.cab
C:\temp\HP_WebRelease\Setup\CreativeProjectsTemplates\CreativeProjectsTemplates.msi
C:\temp\HP_WebRelease\Setup\CSDialogBanner.bmp
C:\temp\HP_WebRelease\Setup\CSDialogBannerRTL.bmp
C:\temp\HP_WebRelease\Setup\csy\ie6setup.exe
C:\temp\HP_WebRelease\Setup\CueTour\CueTour.cab
C:\temp\HP_WebRelease\Setup\CueTour\CueTour.msi
C:\temp\HP_WebRelease\Setup\dan\ie6setup.exe
C:\temp\HP_WebRelease\Setup\Destinations\Destinations.cab
C:\temp\HP_WebRelease\Setup\Destinations\Destinations.msi
C:\temp\HP_WebRelease\Setup\deu\ie6setup.exe
C:\temp\HP_WebRelease\Setup\director\Director.cab
C:\temp\HP_WebRelease\Setup\director\Director.msi
C:\temp\HP_WebRelease\Setup\DocProc\Data1.cab
C:\temp\HP_WebRelease\Setup\DocProc\DocProc.msi
C:\temp\HP_WebRelease\Setup\DocumentViewer\DocumentViewer.cab
C:\temp\HP_WebRelease\Setup\DocumentViewer\DocumentViewer.msi
C:\temp\HP_WebRelease\Setup\ell\ie6setup.exe
C:\temp\HP_WebRelease\Setup\enu\ie6setup.exe
C:\temp\HP_WebRelease\Setup\esn\ie6setup.exe
C:\temp\HP_WebRelease\Setup\fax\fax.cab
C:\temp\HP_WebRelease\Setup\fax\fax.msi
C:\temp\HP_WebRelease\Setup\fin\ie6setup.exe
C:\temp\HP_WebRelease\Setup\fra\ieSetup.exe
C:\temp\HP_WebRelease\Setup\fsshutdown.dat
C:\temp\HP_WebRelease\Setup\HPCommunication.dll
C:\temp\HP_WebRelease\Setup\hpoapd01.exe
C:\temp\HP_WebRelease\Setup\hpoGA.dat
C:\temp\HP_WebRelease\Setup\hpoGJ.dat
C:\temp\HP_WebRelease\Setup\hpok1.dat
C:\temp\HP_WebRelease\Setup\hpok2.dat
C:\temp\HP_WebRelease\Setup\hpomdl05.dat
C:\temp\HP_WebRelease\Setup\hponac.dat
C:\temp\HP_WebRelease\Setup\hponac01.exe
C:\temp\HP_WebRelease\Setup\hponicifs01.exe
C:\temp\HP_WebRelease\Setup\hponiscan01.exe
C:\temp\HP_WebRelease\Setup\Hponiscp01.exe
C:\temp\HP_WebRelease\Setup\hporfd01.exe
C:\temp\HP_WebRelease\Setup\hpoRW.dat
C:\temp\HP_WebRelease\Setup\hposcr05.dat
C:\temp\HP_WebRelease\Setup\hposcr3rdp.dat
C:\temp\HP_WebRelease\Setup\hposcrd4.dat
C:\temp\HP_WebRelease\Setup\hpose045.dat
C:\temp\HP_WebRelease\Setup\hposf045.dat
C:\temp\HP_WebRelease\Setup\hpoVG.dat
C:\temp\HP_WebRelease\Setup\hpowfs01.exe
C:\temp\HP_WebRelease\Setup\hpqhsc01.dat
C:\temp\HP_WebRelease\Setup\hpqscr01.dat
C:\temp\HP_WebRelease\Setup\HPScripting.dll
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1028.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1029.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1030.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1031.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1032.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1033.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1034.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1035.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1036.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1038.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1040.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1041.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1042.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1043.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1044.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1045.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1046.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1049.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1053.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\1055.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\2052.mst
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\Data1.cab
C:\temp\HP_WebRelease\Setup\HPSoftwareUpdate\HPSoftwareUpdate.msi
C:\temp\HP_WebRelease\Setup\HPZapd01.exe
C:\temp\HP_WebRelease\Setup\HPZarp01.exe
C:\temp\HP_WebRelease\Setup\HPZcdl01.exe
C:\temp\HP_WebRelease\Setup\HPZchk01.exe
C:\temp\HP_WebRelease\Setup\HPZddv01.exe
C:\temp\HP_WebRelease\Setup\HPZdui01.exe
C:\temp\HP_WebRelease\Setup\HPZdxs01.exe
C:\temp\HP_WebRelease\Setup\HPZgat01.exe
C:\temp\HP_WebRelease\Setup\HPZlgc01.exe
C:\temp\HP_WebRelease\Setup\HPZmsi01.exe
C:\temp\HP_WebRelease\Setup\HPZnet01.exe
C:\temp\HP_WebRelease\Setup\HPZnfx01.exe
C:\temp\HP_WebRelease\Setup\HPZnop01.exe
C:\temp\HP_WebRelease\Setup\HPZopt01.exe
C:\temp\HP_WebRelease\Setup\hpzopt01.exe.dat
C:\temp\HP_WebRelease\Setup\HPZpnp01.exe
C:\temp\HP_WebRelease\Setup\HPZprl01.exe
C:\temp\HP_WebRelease\Setup\HPZpsc01.exe
C:\temp\HP_WebRelease\Setup\HPZpsl01.exe
C:\temp\HP_WebRelease\Setup\HPZrcv01.exe
C:\temp\HP_WebRelease\Setup\HPZrein01.exe
C:\temp\HP_WebRelease\Setup\HPZsaf01.exe
C:\temp\HP_WebRelease\Setup\HPZscr01.exe
C:\temp\HP_WebRelease\Setup\HPZshl01.exe
C:\temp\HP_WebRelease\Setup\HPZsui01.exe
C:\temp\HP_WebRelease\Setup\HPZtim01.exe
C:\temp\HP_WebRelease\Setup\HPZwis01.exe
C:\temp\HP_WebRelease\Setup\HPZwrp01.exe
C:\temp\HP_WebRelease\Setup\HPZwup01.exe
C:\temp\HP_WebRelease\Setup\hun\ie6setup.exe
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\ImageZoneExpress.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\ImageZoneExpress.msi
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1028.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1028.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1029.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1029.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1030.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1030.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1031.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1031.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1032.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1032.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1033.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1034.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1034.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1035.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1035.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1036.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1036.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1038.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1038.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1040.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1040.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1041.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1041.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1042.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1042.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1043.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1043.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1044.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1044.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1045.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1045.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1046.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1046.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1049.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1049.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1053.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1053.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1055.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang1055.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang2052.cab
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang2052.mst
C:\temp\HP_WebRelease\Setup\ImageZoneExpress\Lang2057.cab
C:\temp\HP_WebRelease\Setup\install1.bmp
C:\temp\HP_WebRelease\Setup\InstantShare\instantshare.cab
C:\temp\HP_WebRelease\Setup\InstantShare\InstantShare.msi
C:\temp\HP_WebRelease\Setup\InternetUtil.dll
C:\temp\HP_WebRelease\Setup\IsDialogBanner.bmp
C:\temp\HP_WebRelease\Setup\IsDialogBannerRTL.bmp
C:\temp\HP_WebRelease\Setup\IsDialogBitmap.bmp
C:\temp\HP_WebRelease\Setup\IsDialogBitmapRTL.bmp
C:\temp\HP_WebRelease\Setup\ita\ie6setup.exe
C:\temp\HP_WebRelease\Setup\jpn\ie6setup.exe
C:\temp\HP_WebRelease\Setup\kor\ie6setup.exe
C:\temp\HP_WebRelease\Setup\LangPacks\esn\langpac1.cab
C:\temp\HP_WebRelease\Setup\LangPacks\esn\langpack.msi
C:\temp\HP_WebRelease\Setup\LangPacks\fra\langpac1.cab
C:\temp\HP_WebRelease\Setup\LangPacks\fra\langpack.msi
C:\temp\HP_WebRelease\Setup\LangPacks\ptb\langpac1.cab
C:\temp\HP_WebRelease\Setup\LangPacks\ptb\langpack.msi
C:\temp\HP_WebRelease\Setup\marketresearch\marketresearch.cab
C:\temp\HP_WebRelease\Setup\marketresearch\marketresearch.msi
C:\temp\HP_WebRelease\Setup\mdfix01.exe
C:\temp\HP_WebRelease\Setup\msvcp60.dll
C:\temp\HP_WebRelease\Setup\msxml3.dll
C:\temp\HP_WebRelease\Setup\msxml3a.dll
C:\temp\HP_WebRelease\Setup\msxml3r.dll
C:\temp\HP_WebRelease\Setup\netfx.msi
C:\temp\HP_WebRelease\Setup\netfx1.cab
C:\temp\HP_WebRelease\Setup\nld\ie6setup.exe
C:\temp\HP_WebRelease\Setup\nor\ie6setup.exe
C:\temp\HP_WebRelease\Setup\Old_1_thank_you.bmp
C:\temp\HP_WebRelease\Setup\opthelp1025.rtf
C:\temp\HP_WebRelease\Setup\opthelp1028.rtf
C:\temp\HP_WebRelease\Setup\opthelp1029.rtf
C:\temp\HP_WebRelease\Setup\opthelp1030.rtf
C:\temp\HP_WebRelease\Setup\opthelp1031.rtf
C:\temp\HP_WebRelease\Setup\opthelp1032.rtf
C:\temp\HP_WebRelease\Setup\opthelp1033.rtf
C:\temp\HP_WebRelease\Setup\opthelp1034.rtf
C:\temp\HP_WebRelease\Setup\opthelp1035.rtf
C:\temp\HP_WebRelease\Setup\opthelp1036.rtf
C:\temp\HP_WebRelease\Setup\opthelp1037.rtf
C:\temp\HP_WebRelease\Setup\opthelp1038.rtf
C:\temp\HP_WebRelease\Setup\opthelp1040.rtf
C:\temp\HP_WebRelease\Setup\opthelp1041.rtf
C:\temp\HP_WebRelease\Setup\opthelp1042.rtf
C:\temp\HP_WebRelease\Setup\opthelp1043.rtf
C:\temp\HP_WebRelease\Setup\opthelp1044.rtf
C:\temp\HP_WebRelease\Setup\opthelp1045.rtf
C:\temp\HP_WebRelease\Setup\opthelp1046.rtf
C:\temp\HP_WebRelease\Setup\opthelp1049.rtf
C:\temp\HP_WebRelease\Setup\opthelp1053.rtf
C:\temp\HP_WebRelease\Setup\opthelp1054.rtf
C:\temp\HP_WebRelease\Setup\opthelp1055.rtf
C:\temp\HP_WebRelease\Setup\opthelp2052.rtf
C:\temp\HP_WebRelease\Setup\panostandalone\panostandalone.cab
C:\temp\HP_WebRelease\Setup\panostandalone\panostandalone.msi
C:\temp\HP_WebRelease\Setup\photogallery\PhotoGallery.cab
C:\temp\HP_WebRelease\Setup\photogallery\PhotoGallery.msi
C:\temp\HP_WebRelease\Setup\plk\ie6setup.exe
C:\temp\HP_WebRelease\Setup\product\1000.msi
C:\temp\HP_WebRelease\Setup\product\1033.mst
C:\temp\HP_WebRelease\Setup\product\1034.mst
C:\temp\HP_WebRelease\Setup\product\1036.mst
C:\temp\HP_WebRelease\Setup\product\1046.mst
C:\temp\HP_WebRelease\Setup\product\1100.msi
C:\temp\HP_WebRelease\Setup\product\1200.msi
C:\temp\HP_WebRelease\Setup\product\1300.msi
C:\temp\HP_WebRelease\Setup\product\1310.msi
C:\temp\HP_WebRelease\Setup\product\1400.msi
C:\temp\HP_WebRelease\Setup\product\1500.msi
C:\temp\HP_WebRelease\Setup\product\1600.msi
C:\temp\HP_WebRelease\Setup\product\2100.msi
C:\temp\HP_WebRelease\Setup\product\2150.msi
C:\temp\HP_WebRelease\Setup\product\2170.msi
C:\temp\HP_WebRelease\Setup\product\2200.msi
C:\temp\HP_WebRelease\Setup\product\2300.msi
C:\temp\HP_WebRelease\Setup\product\2350.msi
C:\temp\HP_WebRelease\Setup\product\2400.msi
C:\temp\HP_WebRelease\Setup\product\2500.cab
C:\temp\HP_WebRelease\Setup\product\2500.msi
C:\temp\HP_WebRelease\Setup\product\2600.cab
C:\temp\HP_WebRelease\Setup\product\2600.msi
C:\temp\HP_WebRelease\Setup\product\2700.cab
C:\temp\HP_WebRelease\Setup\product\2700.msi
C:\temp\HP_WebRelease\Setup\product\4100.msi
C:\temp\HP_WebRelease\Setup\product\4105.msi
C:\temp\HP_WebRelease\Setup\product\4200.msi
C:\temp\HP_WebRelease\Setup\product\5500.msi
C:\temp\HP_WebRelease\Setup\product\6100.msi
C:\temp\HP_WebRelease\Setup\product\6200.msi
C:\temp\HP_WebRelease\Setup\product\7200.cab
C:\temp\HP_WebRelease\Setup\product\7200.msi
C:\temp\HP_WebRelease\Setup\product\7300.cab
C:\temp\HP_WebRelease\Setup\product\7300.msi
C:\temp\HP_WebRelease\Setup\product\7400.cab
C:\temp\HP_WebRelease\Setup\product\7400.msi
C:\temp\HP_WebRelease\Setup\ProductContext\productcontext.cab
C:\temp\HP_WebRelease\Setup\ProductContext\productcontext.msi
C:\temp\HP_WebRelease\Setup\ptb\ie6setup.exe
C:\temp\HP_WebRelease\Setup\QFolder\QFolder.msi
C:\temp\HP_WebRelease\Setup\Readme\readme.msi
C:\temp\HP_WebRelease\Setup\RedBox\Data1.cab
C:\temp\HP_WebRelease\Setup\RedBox\Redbox.msi
C:\temp\HP_WebRelease\Setup\releases\Enterprise\setup\hponac.dat
C:\temp\HP_WebRelease\Setup\RulesEngine.dll
C:\temp\HP_WebRelease\Setup\rus\ie6setup.exe
C:\temp\HP_WebRelease\Setup\Scan\Data1.cab
C:\temp\HP_WebRelease\Setup\Scan\Scan.msi
C:\temp\HP_WebRelease\Setup\ScannerCopy\Data1.cab
C:\temp\HP_WebRelease\Setup\ScannerCopy\ScannerCopy.msi
C:\temp\HP_WebRelease\Setup\Sherlock\1028.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1029.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1030.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1031.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1032.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1033.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1034.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1035.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1036.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1038.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1040.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1041.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1042.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1043.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1044.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1045.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1046.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1049.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1053.mst
C:\temp\HP_WebRelease\Setup\Sherlock\1055.mst
C:\temp\HP_WebRelease\Setup\Sherlock\2052.mst
C:\temp\HP_WebRelease\Setup\Sherlock\HPSystemDiagnostics.msi
C:\temp\HP_WebRelease\Setup\SkinsHP1\SkinsHP1.cab
C:\temp\HP_WebRelease\Setup\SkinsHP1\SkinsHP1.msi
C:\temp\HP_WebRelease\Setup\sve\ie6setup.exe
C:\temp\HP_WebRelease\Setup\Tour\1000tour.cab
C:\temp\HP_WebRelease\Setup\Tour\1000tour.msi
C:\temp\HP_WebRelease\Setup\Tour\1300tour.msi
C:\temp\HP_WebRelease\Setup\Tour\1310tour.cab
C:\temp\HP_WebRelease\Setup\Tour\1310tour.msi
C:\temp\HP_WebRelease\Setup\Tour\2100tour.cab
C:\temp\HP_WebRelease\Setup\Tour\2100tour.msi
C:\temp\HP_WebRelease\Setup\Tour\2150tour.cab
C:\temp\HP_WebRelease\Setup\Tour\2150tour.msi
C:\temp\HP_WebRelease\Setup\Tour\2170tour.cab
C:\temp\HP_WebRelease\Setup\Tour\2170tour.msi
C:\temp\HP_WebRelease\Setup\Tour\2200tour.cab
C:\temp\HP_WebRelease\Setup\Tour\2200tour.msi
C:\temp\HP_WebRelease\Setup\Tour\23_24_2500tour.cab
C:\temp\HP_WebRelease\Setup\Tour\23_24_2500tour.msi
C:\temp\HP_WebRelease\Setup\Tour\4100tour.cab
C:\temp\HP_WebRelease\Setup\Tour\4100tour.msi
C:\temp\HP_WebRelease\Setup\Tour\4200tour.cab
C:\temp\HP_WebRelease\Setup\Tour\4200tour.msi
C:\temp\HP_WebRelease\Setup\Tour\5500tour.cab
C:\temp\HP_WebRelease\Setup\Tour\5500tour.msi
C:\temp\HP_WebRelease\Setup\Tour\6100tour.cab
C:\temp\HP_WebRelease\Setup\Tour\6100tour.msi
C:\temp\HP_WebRelease\Setup\trayapp\TrayApp.cab
C:\temp\HP_WebRelease\Setup\trayapp\TrayApp.msi
C:\temp\HP_WebRelease\Setup\trk\ie6setup.exe
C:\temp\HP_WebRelease\Setup\UnloadIntent\Data1.cab
C:\temp\HP_WebRelease\Setup\UnloadIntent\Unload.msi
C:\temp\HP_WebRelease\Setup\usbready.exe
C:\temp\HP_WebRelease\Setup\webreg\WebReg.cab
C:\temp\HP_WebRelease\Setup\webreg\WebReg.msi
C:\temp\HP_WebRelease\Setup\wis\Win2K_XP\instmsi.exe
C:\temp\HP_WebRelease\Setup\wis\Win9x\instmsi.exe
C:\temp\HP_WebRelease\svc\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\svc\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\svc\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\svc\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\svc\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\svc\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\svc\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\svc\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\svc\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\svc\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\sve\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\tls704d.dll
C:\temp\HP_WebRelease\trk\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\tur\drivers\com_lang\hpfmom12.hl_
C:\temp\HP_WebRelease\tur\drivers\com_lang\hpofax08.dll
C:\temp\HP_WebRelease\tur\drivers\com_lang\hpqish09.dat
C:\temp\HP_WebRelease\tur\drivers\com_lang\hpzl3212.dl_
C:\temp\HP_WebRelease\tur\drivers\com_lang\hpzr3212.dl_
C:\temp\HP_WebRelease\tur\drivers\com_lang\hpzrm312.dl_
C:\temp\HP_WebRelease\tur\drivers\win9x_me\hpoupdrm.inf
C:\temp\HP_WebRelease\tur\drivers\win9x_me\hpzrm112.dl_
C:\temp\HP_WebRelease\tur\drivers\win9x_me\usbmon.dll
C:\temp\HP_WebRelease\tur\drivers\win9x_me\usbprint.sys
C:\temp\HP_WebRelease\usbhub.sys
C:\temp\HP_WebRelease\usbmon.dll
C:\temp\HP_WebRelease\usbprint.sys
C:\temp\HP_WebRelease\util\AIO\hpopdi05.exe
C:\temp\HP_WebRelease\util\AIO\hpopin05.exe
C:\temp\HP_WebRelease\util\CCC\1606fix.reg
C:\temp\HP_WebRelease\util\CCC\240075.exe
C:\temp\HP_WebRelease\util\CCC\270615USAM.EXE
C:\temp\HP_WebRelease\util\CCC\afs2k_install.bat
C:\temp\HP_WebRelease\util\CCC\afs2k_remove.bat
C:\temp\HP_WebRelease\util\CCC\afsinst.exe
C:\temp\HP_WebRelease\util\CCC\chs\Q283787_W2K_SP3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\cht\Q283787_W2K_SP3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\csy\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\dan\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\deu\Q283787_W2K_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\ell\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\enu\Q283787_W2K_SP3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\enu\WindowsXP-KB822603-x86-ENU.exe
C:\temp\HP_WebRelease\util\CCC\esm\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\esn\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\esn\WindowsXP-KB822603-x86-ESN.exe
C:\temp\HP_WebRelease\util\CCC\fin\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\fra\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\fra\WindowsXP-KB822603-x86-FRA.exe
C:\temp\HP_WebRelease\util\CCC\hposcrlr.bat
C:\temp\HP_WebRelease\util\CCC\hun\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\ita\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\jpn\Q283787_W2K_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\kor\Q283787_W2K_SP3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\MediaSizeSettings.exe
C:\temp\HP_WebRelease\util\CCC\nld\Q283787_W2K_SP3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\nob\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\plk\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\ptb\Q283787_W2K_SP3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\ptb\WindowsXP-KB822603-x86-PTB.exe
C:\temp\HP_WebRelease\util\CCC\Q256858_W2K_SP1_x86.EXE
C:\temp\HP_WebRelease\util\CCC\rus\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\sve\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\trk\Q283787_w2k_sp3_x86.EXE
C:\temp\HP_WebRelease\util\CCC\Uninstall.bat
C:\temp\HP_WebRelease\util\CCC\Uninstall_L1.bat
C:\temp\HP_WebRelease\util\CCC\Uninstall_L2.bat
C:\temp\HP_WebRelease\util\CCC\Uninstall_L3.bat
C:\temp\HP_WebRelease\util\CCC\Uninstall_L4.bat
C:\temp\HP_WebRelease\util\cfgmgr32.dll
C:\temp\HP_WebRelease\util\common\hpfpdi12.exe
C:\temp\HP_WebRelease\util\common\hpqisc09.exe
C:\temp\HP_WebRelease\util\common\hpzghl12.exe
C:\temp\HP_WebRelease\util\common\hpzpin12.exe
C:\temp\HP_WebRelease\util\setupapi.dll
C:\temp\HP_WebRelease\util\Support_Tools\MSI_Install_Cleanup\Win2000\msicuu.exe
C:\temp\HP_WebRelease\util\Support_Tools\MSI_Install_Cleanup\Win9x\msicu.exe
C:\temp\NU\Manual\NU2002.PDF
C:\temp\NU\NU\_INST32I.EX_
C:\temp\NU\NU\_ISDel.exe
C:\temp\NU\NU\_ISNU.DLL
C:\temp\NU\NU\_Setup.dll
C:\temp\NU\NU\_sys1.cab
C:\temp\NU\NU\_sys1.hdr
C:\temp\NU\NU\_user1.cab
C:\temp\NU\NU\_user1.hdr
C:\temp\NU\NU\ACTEXT.DLL
C:\temp\NU\NU\ALARM.DLL
C:\temp\NU\NU\ATL.DLL
C:\temp\NU\NU\BACKLOG.EXE
C:\temp\NU\NU\BLUEROCK.BMP
C:\temp\NU\NU\BOOKMARK.OCX
C:\temp\NU\NU\CENTHELP.CNT
C:\temp\NU\NU\CHKASSC.DLL
C:\temp\NU\NU\CLOUDS.BMP
C:\temp\NU\NU\COFRGTST.DLL
C:\temp\NU\NU\COFSTST.DLL
C:\temp\NU\NU\CONDDTST.DLL
C:\temp\NU\NU\COREGTST.DLL
C:\temp\NU\NU\CORSCTST.DLL
C:\temp\NU\NU\CPUUTIL.DLL
C:\temp\NU\NU\CSH.DLL
C:\temp\NU\NU\DAO\DAO2535.TLB
C:\temp\NU\NU\DAO\DAO350.DLL
C:\temp\NU\NU\DAO\MSJET35.DLL
C:\temp\NU\NU\DAO\MSJINT35.DLL
C:\temp\NU\NU\DAO\MSJTER35.DLL
C:\temp\NU\NU\DAO\MSRD2X35.DLL
C:\temp\NU\NU\DAO\VBAJET32.DLL
C:\temp\NU\NU\DAO\VBAR332.DLL
C:\temp\NU\NU\DATA.TAG
C:\temp\NU\NU\data1.cab
C:\temp\NU\NU\data1.hdr
C:\temp\NU\NU\DDENGSC.DLL
C:\temp\NU\NU\DISKEDIT.EXE
C:\temp\NU\NU\DISKEDIT.HLP
C:\temp\NU\NU\DISKEDIT.ICO
C:\temp\NU\NU\DISKEDIT.PID
C:\temp\NU\NU\DSCANATL.DLL
C:\temp\NU\NU\EVENTLG.DLL
C:\temp\NU\NU\EXCLUDE.REG
C:\temp\NU\NU\EXPSRV.DLL
C:\temp\NU\NU\HELPNT\NU.CNT
C:\temp\NU\NU\HELPNT\NU.HLP
C:\temp\NU\NU\HTRKPAGE.DLL
C:\temp\NU\NU\ICMP.DLL
C:\temp\NU\NU\IMAGE32.EXE
C:\temp\NU\NU\IMAGE32.HLP
C:\temp\NU\NU\INSDiag.dll
C:\temp\NU\NU\lang.dat
C:\temp\NU\NU\layout.bin
C:\temp\NU\NU\LNKCOM.DLL
C:\temp\NU\NU\LOGBOOK.CNT
C:\temp\NU\NU\LOGBOOK.EXE
C:\temp\NU\NU\LOGBOOK.HLP
C:\temp\NU\NU\LOGGER.EXE
C:\temp\NU\NU\LOGGERPS.DLL
C:\temp\NU\NU\LUCB.DLL
C:\temp\NU\NU\MAGELLAN.CSS
C:\temp\NU\NU\MARBLE_B.BMP
C:\temp\NU\NU\marker9x.txt
C:\temp\NU\NU\markerNT.txt
C:\temp\NU\NU\MDSCAN.DLL
C:\temp\NU\NU\METAL_A.BMP
C:\temp\NU\NU\METAL_P.BMP
C:\temp\NU\NU\MFC42.DLL
C:\temp\NU\NU\MOONROCK.BMP
C:\temp\NU\NU\MSSHLIB\_INST32I.EX_
C:\temp\NU\NU\MSSHLIB\_Setup.dll
C:\temp\NU\NU\MSSHLIB\_sys1.cab
C:\temp\NU\NU\MSSHLIB\_sys1.hdr
C:\temp\NU\NU\MSSHLIB\_user1.cab
C:\temp\NU\NU\MSSHLIB\_user1.hdr
C:\temp\NU\NU\MSSHLIB\DATA.TAG
C:\temp\NU\NU\MSSHLIB\data1.cab
C:\temp\NU\NU\MSSHLIB\data1.hdr
C:\temp\NU\NU\MSSHLIB\lang.dat
C:\temp\NU\NU\MSSHLIB\layout.bin
C:\temp\NU\NU\MSSHLIB\os.dat
C:\temp\NU\NU\MSSHLIB\Setup.exe
C:\temp\NU\NU\MSSHLIB\SETUP.INI
C:\temp\NU\NU\MSSHLIB\setup.ins
C:\temp\NU\NU\MSSHLIB\setup.iss
C:\temp\NU\NU\MSSHLIB\setup.lid
C:\temp\NU\NU\MSVCIRT.DLL
C:\temp\NU\NU\MSVCP60.DLL
C:\temp\NU\NU\MSVCRT.DLL
C:\temp\NU\NU\MSVCRT40.DLL
C:\temp\NU\NU\MYSTERY.BMP
C:\temp\NU\NU\N32DLIST.DLL
C:\temp\NU\NU\N32DLSTU.DLL
C:\temp\NU\NU\NCOMCAT.DLL
C:\temp\NU\NU\NCOMPARE.EXE
C:\temp\NU\NU\NCOMPARE.HLP
C:\temp\NU\NU\NDD.EXE
C:\temp\NU\NU\NDD.HLP
C:\temp\NU\NU\NDD32.DAT
C:\temp\NU\NU\NDD32.EXE
C:\temp\NU\NU\NDD32.HLP
C:\temp\NU\NU\NDD32.NT
C:\temp\NU\NU\NDDENG.DLL
C:\temp\NU\NU\NDDENGNT.DLL
C:\temp\NU\NU\NDRVEX.DLL
C:\temp\NU\NU\NINTROBJ.DLL
C:\temp\NU\NU\NORTON.EXE
C:\temp\NU\NU\NPComSvr.DLL
C:\temp\NU\NU\NPDRIVER.SYS
C:\temp\NU\NU\NPROTECT.EXE
C:\temp\NU\NU\NPROTECT.VXD
C:\temp\NU\NU\NREGEDIT.EXE
C:\temp\NU\NU\NREGEDIT.HLP
C:\temp\NU\NU\NREGXPRT.EXE
C:\temp\NU\NU\NSMPLOGR.DLL
C:\temp\NU\NU\NTABSHT.DLL
C:\temp\NU\NU\NU.CNT
C:\temp\NU\NU\NU.HLP
C:\temp\NU\NU\NUABOUT.DLL
C:\temp\NU\NU\NUCD.EXE
C:\temp\NU\NU\NUCOM\REGWDOC.EXE
C:\temp\NU\NU\NUFONT.DLL
C:\temp\NU\NU\NUGLOSS.HLP
C:\temp\NU\NU\NUINTRO.DLL
C:\temp\NU\NU\NULIVE.DLL
C:\temp\NU\NU\NUMISC.DLL
C:\temp\NU\NU\NUPLUGIN.DLL
C:\temp\NU\NU\NURESC.DLL
C:\temp\NU\NU\nusess.txt
C:\temp\NU\NU\NUSPLASH.DLL
C:\temp\NU\NU\NUSPLOBJ.DLL
C:\temp\NU\NU\NUTHK16.DLL
C:\temp\NU\NU\NUTHK32.DLL
C:\temp\NU\NU\NWCALLS.DLL
C:\temp\NU\NU\NWDENG.DLL
C:\temp\NU\NU\OAK.BMP
C:\temp\NU\NU\OLEAUT32.DLL
C:\temp\NU\NU\OLEPRO32.DLL
C:\temp\NU\NU\OPTWIZ.DAT
C:\temp\NU\NU\OPTWIZ.EXE
C:\temp\NU\NU\OPTWIZ.HLP
C:\temp\NU\NU\OPTWIZ.NT
C:\temp\NU\NU\os.dat
C:\temp\NU\NU\PAPER_G.BMP
C:\temp\NU\NU\partial.reg
C:\temp\NU\NU\PGNORTON.DLL
C:\temp\NU\NU\README.TXT
C:\temp\NU\NU\REGEXT.DLL
C:\temp\NU\NU\REGOPT.DLL
C:\temp\NU\NU\REGSVR32.EXE
C:\temp\NU\NU\REGTRK.EXE
C:\temp\NU\NU\REGTRK.HLP
C:\temp\NU\NU\RESCUE\_INST32I.EX_
C:\temp\NU\NU\RESCUE\_rscinst.dll
C:\temp\NU\NU\RESCUE\_Setup.dll
C:\temp\NU\NU\RESCUE\_sys1.cab
C:\temp\NU\NU\RESCUE\_sys1.hdr
C:\temp\NU\NU\RESCUE\_user1.cab
C:\temp\NU\NU\RESCUE\_user1.hdr
C:\temp\NU\NU\RESCUE\centhelp.cnt
C:\temp\NU\NU\RESCUE\CHOICE.COM
C:\temp\NU\NU\RESCUE\CloneDlg.exe
C:\temp\NU\NU\RESCUE\config.sys
C:\temp\NU\NU\RESCUE\CPUID.EXE
C:\temp\NU\NU\RESCUE\DATA.TAG
C:\temp\NU\NU\RESCUE\data1.cab
C:\temp\NU\NU\RESCUE\data1.hdr
C:\temp\NU\NU\RESCUE\Defloc.dat
C:\temp\NU\NU\RESCUE\lang.dat
C:\temp\NU\NU\RESCUE\layout.bin
C:\temp\NU\NU\RESCUE\NAVDEF32.DLL
C:\temp\NU\NU\RESCUE\NAVSDK.VXD
C:\temp\NU\NU\RESCUE\NAVSDR32.DLL
C:\temp\NU\NU\RESCUE\NUGloss.HLP
C:\temp\NU\NU\RESCUE\os.dat
C:\temp\NU\NU\RESCUE\RCOMCAT.dll
C:\temp\NU\NU\RESCUE\readme.txt
C:\temp\NU\NU\RESCUE\RescDL.dll
C:\temp\NU\NU\RESCUE\Rescue.dll
C:\temp\NU\NU\RESCUE\RESCUE.EXE
C:\temp\NU\NU\RESCUE\Rescue32.cnt
C:\temp\NU\NU\RESCUE\Rescue32.exe
C:\temp\NU\NU\RESCUE\RESCUE32.HLP
C:\temp\NU\NU\RESCUE\RESCUED.HLP
C:\temp\NU\NU\RESCUE\RESCUEDV.EXE
C:\temp\NU\NU\RESCUE\RESCUEN.EXE
C:\temp\NU\NU\RESCUE\REXCLUDE.REG
C:\temp\NU\NU\RESCUE\RNavOem.dll
C:\temp\NU\NU\RESCUE\RSCFMT.DLL
C:\temp\NU\NU\RESCUE\RShell.EXE
C:\temp\NU\NU\RESCUE\RShelln.exe
C:\temp\NU\NU\RESCUE\RShellv.EXE
C:\temp\NU\NU\RESCUE\S32FATL.DLL
C:\temp\NU\NU\RESCUE\S32GUIL.DLL
C:\temp\NU\NU\RESCUE\S32KRNLL.DLL
C:\temp\NU\NU\RESCUE\S32SYSL.DLL
C:\temp\NU\NU\RESCUE\S32UTILL.DLL
C:\temp\NU\NU\RESCUE\ScsiDll.Dll
C:\temp\NU\NU\RESCUE\Setup.exe
C:\temp\NU\NU\RESCUE\SETUP.INI
C:\temp\NU\NU\RESCUE\setup.ins
C:\temp\NU\NU\RESCUE\setup.iss
C:\temp\NU\NU\RESCUE\setup.lid
C:\temp\NU\NU\RESCUE\SYMKRNLL.DLL
C:\temp\NU\NU\RESCUE\SYMKRNLL.VXD
C:\temp\NU\NU\RESCUE\TKKE16L.DLL
C:\temp\NU\NU\RESCUE\TKKE32L.DLL
C:\temp\NU\NU\RESCUE\TROUBLE.TXT
C:\temp\NU\NU\RESCUE\VIEW.COM
C:\temp\NU\NU\RNAPH.DLL
C:\temp\NU\NU\RSCAN.DLL
C:\temp\NU\NU\RSUNDO.DLL
C:\temp\NU\NU\S32DMAPL.DLL
C:\temp\NU\NU\S32FATL.DLL
C:\temp\NU\NU\S32GUIL.DLL
C:\temp\NU\NU\S32KRNLL.DLL
C:\temp\NU\NU\S32MAILL.DLL
C:\temp\NU\NU\S32MTHKL.DLL
C:\temp\NU\NU\S32NPTL.DLL
C:\temp\NU\NU\S32RASU.DLL
C:\temp\NU\NU\S32STAT.DLL
C:\temp\NU\NU\S32SYSL.DLL
C:\temp\NU\NU\S32UTILL.DLL
C:\temp\NU\NU\SALTHK16.DLL
C:\temp\NU\NU\SALTHK32.DLL
C:\temp\NU\NU\SD32.EXE
C:\temp\NU\NU\SD32.HLP
C:\temp\NU\NU\SD32ENG.DLL
C:\temp\NU\NU\SD32VXD.VXD
C:\temp\NU\NU\SDNT\_INST32I.EX_
C:\temp\NU\NU\SDNT\_ISDEL.EXE
C:\temp\NU\NU\SDNT\_SETUP.DLL
C:\temp\NU\NU\SDNT\_sys1.cab
C:\temp\NU\NU\SDNT\_user1.cab
C:\temp\NU\NU\SDNT\DATA.TAG
C:\temp\NU\NU\SDNT\data1.cab
C:\temp\NU\NU\SDNT\lang.dat
C:\temp\NU\NU\SDNT\layout.bin
C:\temp\NU\NU\SDNT\os.dat
C:\temp\NU\NU\SDNT\SETUP.EXE
C:\temp\NU\NU\SDNT\SETUP.INI
C:\temp\NU\NU\SDNT\setup.ins
C:\temp\NU\NU\SDNT\setup.iss
C:\temp\NU\NU\SDNT\setup.lid
C:\temp\NU\NU\SEARCH.AVI
C:\temp\NU\NU\SECACL.DLL
C:\temp\NU\NU\SENSOR32.DLL
C:\temp\NU\NU\SEP_2.GIF
C:\temp\NU\NU\Setup.exe
C:\temp\NU\NU\SETUP.INI
C:\temp\NU\NU\setup.ins
C:\temp\NU\NU\setup.lid
C:\temp\NU\NU\SETVER.PID
C:\temp\NU\NU\SI32.EXE
C:\temp\NU\NU\SI32.HLP
C:\temp\NU\NU\SIDESYM2.GIF
C:\temp\NU\NU\SIREGIST.EXE
C:\temp\NU\NU\sku.reg
C:\temp\NU\NU\SLATE.BMP
C:\temp\NU\NU\SMARTDRV\SMARTDRV.TXT
C:\temp\NU\NU\SMARTDRV\SMARTUPD.EXE
C:\temp\NU\NU\SPACER.GIF
C:\temp\NU\NU\SPDSTART.EXE
C:\temp\NU\NU\SPDSTART.VXD
C:\temp\NU\NU\STONE_G.BMP
C:\temp\NU\NU\STYLE.CSS
C:\temp\NU\NU\SUNSET.BMP
C:\temp\NU\NU\SUPPORT.CNT
C:\temp\NU\NU\SUPPORT.HLP
C:\temp\NU\NU\SYMCOM.DLL
C:\temp\NU\NU\SYMGUNDO.DLL
C:\temp\NU\NU\SYMKRNLL.DLL
C:\temp\NU\NU\SYMKRNLL.VXD
C:\temp\NU\NU\SYMMIGR8.DLL
C:\temp\NU\NU\SYMMONIT.VXD
C:\temp\NU\NU\SYMPRREC.DLL
C:\temp\NU\NU\SYMUNDO.EXE
C:\temp\NU\NU\SYMUNDPS.DLL
C:\temp\NU\NU\SYSCHECK.EXE
C:\temp\NU\NU\SYSCHECK.HLP
C:\temp\NU\NU\SYSDOC32.EXE
C:\temp\NU\NU\SYSDOC32.HLP
C:\temp\NU\NU\SYSINFO.VXD
C:\temp\NU\NU\SYSNT\ATL.DLL
C:\temp\NU\NU\TKKE16L.DLL
C:\temp\NU\NU\TKKE32L.DLL
C:\temp\NU\NU\TRKENG.DLL
C:\temp\NU\NU\UE32.DAT
C:\temp\NU\NU\UE32.EXE
C:\temp\NU\NU\UE32.HLP
C:\temp\NU\NU\UE32.NT
C:\temp\NU\NU\UEBMP32.DLL
C:\temp\NU\NU\UNERASE.EXE
C:\temp\NU\NU\UNERASE.HLP
C:\temp\NU\NU\UNFORMAT.EXE
C:\temp\NU\NU\UNFORMAT.HLP
C:\temp\NU\NU\URLCACHE.DLL
C:\temp\NU\NU\USHELLEX.DLL
C:\temp\NU\NU\VSENSOR.VXD
C:\temp\NU\NU\WALNUT.BMP
C:\temp\NU\NU\WATERFAL.BMP
C:\temp\NU\NU\WDSCAN.EXE
C:\temp\NU\NU\WFSHELEX.DLL
C:\temp\NU\NU\WINDOC.DAT
C:\temp\NU\NU\WINDOC.EXE
C:\temp\NU\NU\WINDOC.HLP
C:\temp\NU\NU\WINDOC.NT
C:\temp\NU\NU\WINSOX16.DLL
C:\temp\NU\NU\WINSOX32.DLL
C:\temp\NU\NU\WIPEDLL.DLL
C:\temp\NU\NU\WIPEINFO.DAT
C:\temp\NU\NU\WIPEINFO.EXE
C:\temp\NU\NU\WIPEINFO.HLP
C:\temp\NU\NU\WIPEINFO.NT
C:\temp\NU\NU\WIPINFNT.EXE
C:\temp\NU\NU\WIPINFNT.HLP
C:\temp\NU\NU\WIPINFNT.NT
C:\temp\NU\NUSetup.exe
C:\temp\NU\README.TXT
C:\temp\NU\Support\ComCtl32\50comupd.exe
C:\temp\NU\Support\EDisk\Disk1.img
C:\temp\NU\Support\EDisk\Disk2.img
C:\temp\NU\Support\EDisk\NED.exe
C:\temp\NU\Support\EDisk\readme.txt
C:\temp\NU\Support\Integrat\NMAIN.EXE
C:\temp\NU\Support\Integrat\SYMEXCPT.DLL
C:\temp\NU\Support\LiveReg\lrsetup.exe
C:\temp\NU\Support\LUpdate\lusetup.exe
C:\temp\NU\Support\sevinst\sevinst.exe
C:\temp\NU\Support\Wintdist\wintdist.exe
C:\WINDOWS\system32\bdir
C:\WINDOWS\system32\bdir\ZAXR429I26.exe
C:\WINDOWS\system32\dbl
C:\WINDOWS\system32\mpull
C:\WINDOWS\system32\mpull\MAG32015x.exe
C:\WINDOWS\system32\tec
C:\WINDOWS\system32\tec\tvgrem041.exe
C:\WINDOWS\system32\towl
C:\WINDOWS\system32\towl\SAT4510net.exe
C:\WINDOWS\system32\wTR02
C:\WINDOWS\system32\wTR02\wTR022328.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MTLMNT55
-------\Service_mtlmnt55
((((((((((((((((((((((((( Files Created from 2008-08-01 to 2008-09-01 )))))))))))))))))))))))))))))))
.
2008-08-30 16:49 . 2008-08-31 01:36 1,476 --a------ C:\WINDOWS\wininit.ini
2008-08-30 11:59 . 2008-08-30 11:59 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-08-30 11:14 . 2008-08-30 11:24 134,358,357 --a------ C:\PC-GAMES - Risk 2 (Tested).zip
2008-08-30 11:02 . 2008-08-30 11:02 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2008-08-30 10:50 . 2008-08-30 23:28 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- C:\WINDOWS\Sun
2008-08-30 10:42 . 2008-08-30 12:13 <DIR> d-------- C:\Documents and Settings\Stan\Application Data\LimeWire
2008-08-30 10:41 . 2008-08-30 10:41 <DIR> d-------- C:\Program Files\Java
2008-08-30 10:41 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-30 10:40 . 2008-08-30 10:40 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-21 20:06 . 2008-08-21 20:35 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-17 18:44 . 2008-08-17 18:44 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-08-13 22:08 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-08 18:51 . 1999-04-23 22:22 528,384 --a------ C:\WINDOWS\KODAKIMG.EXE
2008-08-08 18:51 . 1999-04-23 22:22 114,688 --a------ C:\WINDOWS\KODAKPRV.EXE
2008-08-08 16:49 . 2008-08-08 16:49 <DIR> d-------- C:\Program Files\TWAIN Working Group
2008-08-08 16:49 . 1998-02-06 22:37 299,520 --a------ C:\WINDOWS\uninst.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-30 16:08 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-11 18:26 --------- d-----w C:\Documents and Settings\Stan\Application Data\WeatherBug
2006-03-23 00:31 28,856 ----a-w C:\Documents and Settings\Stan\Application Data\GDIPFONTCACHEV1.DAT
2005-12-30 06:34 2 --shatr C:\WINDOWS\winstart.bat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-01-13 18:05 69632]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 13:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
C:\Documents and Settings\Stan\Start Menu\Programs\Startup\
Toolbar.lnk.disabled [2006-01-11 01:11:10 734]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Service Manager.lnk.disabled [2006-01-17 09:04:27 577]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifcaxuu]
[BU]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"=
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RegRun WinBait"=C:\WINDOWS\winbait.exe
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"kgsystray"=g:\Program Files\Kuma Games\kgsystray\Kumawar_tray.exe
"KW2SysTray"=G:\Program Files\Kuma Games\KW2SysTray\Kumawar_tray.exe
"pccguide.exe"="E:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"G:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc8fefc3-fa4a-11dc-a98e-000476cea4ef}]
\Shell\AutoRun\command - L:\LaunchU3.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-01 09:08:58
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\snmp.exe
C:\Program Files\Speed Disk\NOPDB.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\WINDOWS\system32\devldr32.exe
.
**************************************************************************
.
Completion time: 2008-09-01 9:11:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-01 13:11:17
ComboFix2.txt 2008-09-01 12:27:16
Pre-Run: 4,220,796,928 bytes free
Post-Run: 4,164,157,440 bytes free
1507 --- E O F --- 2008-08-14 21:21:05
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:59 AM, on 9/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Stan\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ptdprolog.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - Startup: Toolbar.lnk.disabled
O4 - Global Startup: Service Manager.lnk.disabled
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://remote.superiorink.com/dana-cached/setup/NeoterisSetup.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135197102328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
O16 - DPF: {E1AD733A-8259-49EF-980F-C5AB69F12D06} (RunKuma Control) - http://www.kumagames.com/runkuma.cab
O20 - Winlogon Notify: iifcaxuu - C:\WINDOWS\
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 6341 bytes
Have you put anything to C:\temp on purpose?
OK, then those are downloaded by program updates.
Open HijackThis, click do a system scan only and checkmark these:
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} -
O20 - Winlogon Notify: iifcaxuu - C:\WINDOWS\
Close all windows including browser and press fix checked.
Reboot.
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, September 1, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, September 01, 2008 14:05:23
Records in database: 1173357
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: no
Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
Scan statistics:
Files scanned: 162753
Threat name: 6
Infected objects: 12
Suspicious objects: 0
Duration of the scan: 02:22:56
File name / Threat name / Threats count
C:\QooBox\Quarantine\C\services.exe.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\smss.exe.vir Infected: Trojan-Downloader.Win32.VB.hff 1
C:\QooBox\Quarantine\C\WINDOWS\faceback.exe.vir Infected: Trojan-Downloader.Win32.Agent.adtd 1
C:\QooBox\Quarantine\C\WINDOWS\system32\awtustqQ.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\iifcaxuu.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lphc39oj0e91v.exe.vir Infected: Backdoor.Win32.Frauder.cb 1
C:\QooBox\Quarantine\C\WINDOWS\system32\towl\SAT4510net.exe.vir Infected: Trojan-Downloader.Win32.Small.buy 1
C:\QooBox\Quarantine\C\WINDOWS\system32\wTR02\wTR022328.exe.vir Infected: Trojan-Downloader.Win32.VB.hff 1
D:\Data\SoftwareInstallations\RoboForm\AiRoboForm.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
D:\Data\SoftwareInstallations\WeatherBug\WxBugSetup60b6[1].06.0.0.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
J:\DataBackUp\SoftwareInstallations\RoboForm\AiRoboForm.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
J:\DataBackUp\SoftwareInstallations\WeatherBug\WxBugSetup60b6[1].06.0.0.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
The selected area was scanned.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:06:18 PM, on 9/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Stan\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ptdprolog.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - Startup: Toolbar.lnk.disabled
O4 - Global Startup: Service Manager.lnk.disabled
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://remote.superiorink.com/dana-cached/setup/NeoterisSetup.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135197102328
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
O16 - DPF: {E1AD733A-8259-49EF-980F-C5AB69F12D06} (RunKuma Control) - http://www.kumagames.com/runkuma.cab
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 6181 bytes
Please re-enable Trend.
Empty this folder:
C:\QooBox\Quarantine
Delete these:
D:\Data\SoftwareInstallations\WeatherBug
J:\DataBackUp\SoftwareInstallations\WeatherBug
Empty Recycle Bin.
Still problems?
Everything is back to normal. Thanks again.
StanMi
Great :)
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
You can fix this, it's a leftover:
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /u in the runbox and click OK
Next we remove all used tools.
Please download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to desktop.
Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and re-enable system restore here:
Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)
Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
Malwarebytes' Anti-Malware Setup Guide (http://www.bfccomputers.com/forum/index.php?showtopic=1644)
Malwarebytes' Anti-Malware Scanning Guide (http://www.bfccomputers.com/forum/index.php?showtopic=1645)
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
Here are some additional utilities that will enhance your safety
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://forums.spybot.info/showthread.php?t=279)
Happy surfing and stay clean! :bigthumb:
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.